tegwick
b5da745063
- application.access allows only with purpose=readback and the authoring human bar; no workload path, no audience or client-scoped claims - v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04 - examples/application-readback: readback catalogue with informed-decision's key-cape client binding; integration test over the shipped files Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
58 lines
1.2 KiB
JSON
58 lines
1.2 KiB
JSON
[
|
|
{
|
|
"id": "unknown-request-denied",
|
|
"request": {
|
|
"id": "unknown",
|
|
"subject": {
|
|
"id": "unknown",
|
|
"type": "human"
|
|
},
|
|
"action": "lifecycle.register",
|
|
"resource": {
|
|
"id": "memo:unknown",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision"
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny"
|
|
}
|
|
},
|
|
{
|
|
"id": "application-access-without-readback-purpose-denied",
|
|
"request": {
|
|
"id": "application-access-enforcement",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "human-one",
|
|
"type": "human",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"groups": [
|
|
"net-kingdom-admins"
|
|
],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": [
|
|
"pwd",
|
|
"otp"
|
|
],
|
|
"at": 0
|
|
}
|
|
}
|
|
},
|
|
"action": "application.access",
|
|
"resource": {
|
|
"id": "informed-decision",
|
|
"type": "application",
|
|
"system": "informed-decision"
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "lifecycle_scope_or_identity_refused"
|
|
}
|
|
}
|
|
]
|