access-engine/examples/secrets-engine-task-execution/policy_package.md

id	name	namespace	version	status	package	allow_ttl	actions	owner	fixtures	caring	activation
secrets-engine.task-execution	Secrets exact task execution	secrets-engine:secret-catalog-lane	v1	proposed	flexauth.secrets_engine.task_execution	15s	execute-ccr	team:platform-security	policy_fixtures.yaml	profile enforce caring-0.4.0-rc2 false	mode local

Proposed task execution contract

Source only. The owner-admission constant is false because no authenticated initiating-principal projection or User/Tenant membership provider has been admitted. Request flags, even verified=true, cannot change that constant. Activating this package today denies every request. It does not replace lifecycle v2. Any successor that changes owner_admission requires review of the actual server injection boundary and authoritative providers, not a values switch.

The candidate predicate models the future join, not a trustworthy caller claim. It is exercised with synthetic server projections in tests. Raw human tokens must never enter CheckRequest/context/decision records. See the accompanying source verifier and provider contract; neither is wired into HTTP evaluation.

owner_admission := false

default decision := {"effect": "deny", "reason": "initiating_provider_unadmitted"}

decision := {"effect": "allow", "reason": "exact_task_execution_matched"} {
  owner_admission
  candidate_matches
}

hash_ok(x) { is_string(x); regex.match("^sha256:[0-9a-f]{64}$", x) }

candidate_matches {
  input.action == "execute-ccr"
  input.tenant == "tenant:platform"
  input.subject.id == "secrets-engine"
  input.subject.type == "service"
  input.resource.system == "secrets-engine"
  input.resource.type == "secret-catalog-lane"
  input.context.human_control == true
  c := input.context.execution_contract
  c.contract_version == "SECRETS-EXEC-20261011-v1"
  c.operation == "metadata-apply-ccr"
  c.execution_actor == "service:secrets-engine"
  regex.match("^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", c.operation_id)
  c.ccr_id != c.execution_grant_ccr_id
  hash_ok(c.ccr_immutable_sha256)
  hash_ok(c.grant_immutable_sha256)
  hash_ok(c.catalog_sha256)
  hash_ok(c.expected_before)
  hash_ok(c.expected_after)
  c.backend_budget.ttl_seconds <= 120
  c.backend_budget.ttl_seconds >= 30
  c.backend_budget.uses == 12
  count(c.operations) == 6
  c.operations[0].method == "GET"
  c.operations[1].method == "PUT"
  c.operations[2].method == "GET"
  c.operations[3].method == "GET"
  c.operations[4].method == "PUT"
  c.operations[5].method == "GET"
  regex.match("^sys/policies/acl/[A-Za-z0-9_-]+$", c.operations[0].path)
  regex.match("^auth/[A-Za-z0-9_-]+/role/[A-Za-z0-9_-]+$", c.operations[3].path)
  c.operations[0].path == c.operations[1].path
  c.operations[1].path == c.operations[2].path
  c.operations[3].path == c.operations[4].path
  c.operations[4].path == c.operations[5].path
  every_operation_hash_valid
  p := input.context.task_execution_projection
  p.version == "proposed-task-execution-projection/v1"
  p.principal_type == "human"
  p.subject != ""
  p.tenant == input.tenant
  p.tenant_source == "directory"
  p.mfa == true
  p.transport_principal == "system:serviceaccount:secrets-engine:secrets-engine"
  p.execution_contract_digest == concat("", ["sha256:", crypto.sha256(json.marshal(c))])
  p.resource_id == input.resource.id
  p.membership_source == "user-engine"
  p.tenant_state_source == "tenant-engine"
  p.member_active == true
  p.tenant_active == true
  p.not_after_ns > time.now_ns()
  p.not_after_ns <= time.parse_rfc3339_ns(c.operation_deadline)
  input.context.approval.kind == "approval-claim"
  input.context.approval.binding.human_control == true
}

every_operation_hash_valid {
  count([x | x := input.context.execution_contract.operations[_]; hash_ok(x.payload_sha256)]) == 6
}

import data.flexauth.secrets_engine.task_execution

test_unsigned_admission_flags_cannot_open {
  task_execution.decision == {"effect": "deny", "reason": "initiating_provider_unadmitted"}
    with input as {"context": {"verified": true, "owner_admission": true, "human_control": true}}
}