tegwick
8f2ba75e4a
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted. - serve-readback: dedicated pin, no enforcement routes, own caller binding - CheckRequest.purpose hashed into every digest when set; /v1/check refuses it - POST /v1/readback/application_access and GET /v1/readback/systems - optional client_binding on protected systems; readback schemas - schemaguard implements maxItems - T05 added: informed-decision needs an application.access rule over realm-level claims (its lifecycle rules read authentication_audience) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
24 lines
646 B
YAML
24 lines
646 B
YAML
- id: fixture:demo-app-access-allow
|
|
request:
|
|
subject:
|
|
id: user:alice
|
|
attributes:
|
|
groups: [app-users]
|
|
assurance: {level: aal2, mfa: true}
|
|
action: application.access
|
|
resource: {id: demo-app, type: application, system: demo-app}
|
|
expect:
|
|
effect: allow
|
|
reason: app_user
|
|
- id: fixture:demo-app-access-deny-no-mfa
|
|
request:
|
|
subject:
|
|
id: user:bob
|
|
attributes:
|
|
groups: [app-users]
|
|
assurance: {level: aal1, mfa: false}
|
|
action: application.access
|
|
resource: {id: demo-app, type: application, system: demo-app}
|
|
expect:
|
|
effect: deny
|
|
reason: no_matching_rule
|