coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/examples/ops-warden-fetch/policy_fixtures.yaml
tegwick 02b15a7f72
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m12s
Details
access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:57:11 +02:00

300 lines
7.6 KiB
YAML
Raw Blame History

- id: fixture:ops-warden-fetch-allow-forgejo-admin-api-token
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: allow
reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-openrouter-llm-connect
request:
id: check:ops-warden-fetch-openrouter-llm-connect
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:openrouter-llm-connect
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: openrouter-llm-connect
owner_repo: railiance-platform
domain: null
expect:
effect: allow
reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-rapp-qonto-keycape-client
request:
id: check:ops-warden-fetch-rapp-qonto-keycape-client
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:rapp-qonto-keycape-client
type: secret
system: key-cape
tenant: tenant:platform
context:
need_id: rapp-qonto-keycape-client
owner_repo: key-cape
domain: null
expect:
effect: allow
reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-allow-domain-suffix
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token/infotech
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: infotech
expect:
effect: allow
reason: secret_read_lane_matched
- id: fixture:ops-warden-fetch-deny-unknown-need
request:
id: check:ops-warden-fetch-no-such-need
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:no-such-need
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: no-such-need
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: unknown_need
- id: fixture:ops-warden-fetch-deny-not-exec-capable-need
request:
id: check:ops-warden-fetch-net-kingdom-lldap-bind-credential
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:net-kingdom-lldap-bind-credential
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: net-kingdom-lldap-bind-credential
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: unknown_need
- id: fixture:ops-warden-fetch-deny-login-lane-need
request:
id: check:ops-warden-fetch-openbao-platform-admin-login
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:openbao-platform-admin-login
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: openbao-platform-admin-login
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: unknown_need
- id: fixture:ops-warden-fetch-deny-wrong-system
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: key-cape
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: key-cape
domain: null
expect:
effect: deny
reason: wrong_system
- id: fixture:ops-warden-fetch-deny-unknown-system
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: secrets-engine
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: secrets-engine
domain: null
expect:
effect: deny
reason: unknown_system
- id: fixture:ops-warden-fetch-deny-non-secret-type
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: ssh-certificate
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: wrong_resource_type
- id: fixture:ops-warden-fetch-deny-wrong-action
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: write
resource:
id: secret:forgejo-admin-api-token
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: wrong_action
- id: fixture:ops-warden-fetch-deny-wrong-tenant
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:acme
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: railiance-platform
tenant: tenant:acme
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: wrong_tenant
- id: fixture:ops-warden-fetch-deny-wrong-subject-type
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: agt
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: wrong_subject_type
- id: fixture:ops-warden-fetch-deny-resource-need-mismatch
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:openrouter-llm-connect
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: railiance-platform
domain: null
expect:
effect: deny
reason: resource_need_mismatch
- id: fixture:ops-warden-fetch-deny-owner-repo-mismatch
request:
id: check:ops-warden-fetch-forgejo-admin-api-token
subject:
id: operator
type: operator
tenant: tenant:platform
action: read
resource:
id: secret:forgejo-admin-api-token
type: secret
system: railiance-platform
tenant: tenant:platform
context:
need_id: forgejo-admin-api-token
owner_repo: key-cape
domain: null
expect:
effect: deny
reason: owner_repo_mismatch
Reference in a new issue View git blame Copy permalink