178 lines
3.4 KiB
YAML
178 lines
3.4 KiB
YAML
id: tenant-engine
|
|
name: Tenant Engine
|
|
resource_types:
|
|
- name: tenant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant record (existence, onboarding grouping).
|
|
- name: role-grant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
metadata:
|
|
description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
|
|
- name: plan-assignment
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant's plan/subscription assignment (by reference id).
|
|
- name: guardrail
|
|
scope_level: Resource
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
metadata:
|
|
description: >-
|
|
A tenant's resolved ceiling (spend, seats, and similar limits) plus
|
|
the provenance of that value. Not an entitlement and not a meter.
|
|
actions:
|
|
- name: tenant.read
|
|
capabilities:
|
|
- View
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.create
|
|
capabilities:
|
|
- Create
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.grant
|
|
capabilities:
|
|
- Grant
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.revoke
|
|
capabilities:
|
|
- Revoke
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.read
|
|
capabilities:
|
|
- View
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.read.live
|
|
capabilities:
|
|
- View
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.plan.assign
|
|
capabilities:
|
|
- Bind
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.update
|
|
capabilities:
|
|
- EditAny
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.retire
|
|
capabilities:
|
|
- Archive
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.reactivate
|
|
capabilities:
|
|
- Restore
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.guardrail.read
|
|
capabilities:
|
|
- View
|
|
- Audit
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.guardrail.set
|
|
capabilities:
|
|
- EditAny
|
|
- Audit
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
caring_profiles:
|
|
- caring-0.4.0-rc2
|
|
metadata:
|
|
flex_auth_contract: protected-system-v0
|
|
boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md
|