coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/cmd/flex-auth/testdata/readback/other-app/policy_package.md
tegwick 8f2ba75e4a
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 58s
Details
FLEX-WP-0035 T01-T03: application access readback pin 
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted.
- serve-readback: dedicated pin, no enforcement routes, own caller binding
- CheckRequest.purpose hashed into every digest when set; /v1/check refuses it
- POST /v1/readback/application_access and GET /v1/readback/systems
- optional client_binding on protected systems; readback schemas
- schemaguard implements maxItems
- T05 added: informed-decision needs an application.access rule over
  realm-level claims (its lifecycle rules read authentication_audience)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
2026-10-09 20:02:31 +02:00

1.2 KiB
Raw Blame History

id name namespace version status package actions owner fixtures caring
testdata.other-app readback test package other-app testdata:other-app v1 fixture flexauth.testdata.other_app
read
team:platform-security
policy_fixtures.yaml
profile enforce canonical_roles organization_relations scopes planes capabilities exposure_modes conditions restrictions
caring-0.4.0-rc2 false
Operator
ServiceProvider
level id tenant
Platform platform:testdata tenant:platform
Identity
Use
Metadata
Logged
PrivilegeEscalationBlocked

Readback test package (FLEX-WP-0035)

Test-only. Do not copy.

import future.keywords.if
import future.keywords.in

default decision := {"effect": "deny", "reason": "no_matching_rule"}

decision := {"effect": "allow", "reason": "app_user"} if {
  input.action == "application.access"
  "app-users" in input.subject.attributes.groups
  input.subject.attributes.assurance.mfa == true
}

package flexauth.testdata.other_app_test
import future.keywords.if
import data.flexauth.testdata.other_app

test_default_deny if {
  other_app.decision.effect == "deny" with input as {"action": "read", "subject": {"attributes": {}}}
}