tegwick
e85f511c4f
Compact-sitting v8 can admit a new memo from carried class, submitter, and approval attributes, but shipped sets are empty and exact-record decisions stay on their pins. The sitting image pin is unchanged. Assistant: grok Assistant-Session: 01a10329-31cb-78d3-b7a3-788c2f91d6d4
140 lines
4.1 KiB
JSON
140 lines
4.1 KiB
JSON
[
|
|
{
|
|
"id": "attribute-non-human-refused",
|
|
"request": {
|
|
"id": "attribute-non-human",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "not-a-person",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 1
|
|
}
|
|
}
|
|
},
|
|
"action": "accept",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "identity_refused"
|
|
}
|
|
},
|
|
{
|
|
"id": "attribute-stale-mfa",
|
|
"request": {
|
|
"id": "attribute-stale-mfa",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "test-human",
|
|
"type": "human",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 1
|
|
}
|
|
}
|
|
},
|
|
"action": "accept",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "stale_mfa"
|
|
}
|
|
},
|
|
{
|
|
"id": "attribute-future-mfa",
|
|
"request": {
|
|
"id": "attribute-future-mfa",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "test-human",
|
|
"type": "human",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 9999999999
|
|
}
|
|
}
|
|
},
|
|
"action": "read",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "identity_refused"
|
|
}
|
|
}
|
|
]
|