tegwick
0ced2995ee
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine - cmd/flex-auth: prints the rename and exits 2, with a test - image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside; live pins pass only args, so their next roll is unaffected - Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans, decisions and ADRs left as written - runtime names (module, audience, k8s, image package, /opt paths) unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
37 lines
1.9 KiB
Markdown
37 lines
1.9 KiB
Markdown
# user-engine policy service
|
|
|
|
Dynamic human subjects arrive as verified KeyCape claims, so the registry
|
|
defines the protected system while the policy evaluates tenant, roles, and
|
|
self context from each request. Platform operators may cross tenants;
|
|
tenant administrators and self-service users may not.
|
|
|
|
Validate with:
|
|
|
|
```bash
|
|
access-engine test-policy -file examples/user-engine/policy_package.md
|
|
access-engine load-registry -file examples/user-engine/registry_snapshot.json
|
|
```
|
|
|
|
## Live production (FLEX-WP-0009-T04, 2026-08-16)
|
|
|
|
Service: `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`
|
|
Image: `forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
|
|
|
|
`test-policy` reports 9/9 Rego tests and 9/9 fixtures. The same nine
|
|
fixtures were replayed against the deployed `/v1/check` and all matched:
|
|
|
|
| Fixture | Effect / reason | Decision id |
|
|
| --- | --- | --- |
|
|
| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` |
|
|
| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` |
|
|
| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` |
|
|
| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` |
|
|
| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` |
|
|
| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` |
|
|
| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` |
|
|
| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` |
|
|
| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` |
|
|
|
|
From the user-engine namespace the Service `/healthz` is HTTP 200.
|
|
Unavailability is connection-refused / NXDOMAIN; the consumer adapter
|
|
denies with `authorization service unavailable`.
|