65 lines
2 KiB
YAML
65 lines
2 KiB
YAML
id: subjects:tenant-engine-operators
|
|
tenants:
|
|
- id: tenant:platform
|
|
name: Platform Tenant
|
|
subjects:
|
|
- id: tenant-engine
|
|
type: Service
|
|
display_name: tenant-engine service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-writers
|
|
- group:tenant-engine-readers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
tenant-engine's own service identity, used for the nine write-API
|
|
actions it sends to POST /v1/check
|
|
(authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
|
|
tenant.role.revoke, tenant.plan.assign, the lifecycle actions
|
|
tenant.update, tenant.retire, tenant.reactivate, and the
|
|
guardrail actions tenant.guardrail.read, tenant.guardrail.set.
|
|
- id: user-engine
|
|
type: Service
|
|
display_name: user-engine service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-writers
|
|
- group:tenant-engine-readers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
user-engine's service identity. It owns the portal workflow that reads
|
|
and mutates tenant lifecycle records through tenant-engine.
|
|
- id: flex-auth
|
|
type: Service
|
|
display_name: flex-auth service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-readers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
flex-auth's own service identity. Authorized only for
|
|
tenant.guardrail.read so the PDP can consume ceilings without
|
|
being able to change them (FLEX-WP-0014).
|
|
groups:
|
|
- id: group:tenant-engine-writers
|
|
display_name: tenant-engine Write API Callers
|
|
members:
|
|
- tenant-engine
|
|
- user-engine
|
|
tenant: tenant:platform
|
|
- id: group:tenant-engine-readers
|
|
display_name: tenant-engine Guardrail Readers
|
|
members:
|
|
- flex-auth
|
|
- tenant-engine
|
|
- user-engine
|
|
tenant: tenant:platform
|