tegwick
8f2ba75e4a
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted. - serve-readback: dedicated pin, no enforcement routes, own caller binding - CheckRequest.purpose hashed into every digest when set; /v1/check refuses it - POST /v1/readback/application_access and GET /v1/readback/systems - optional client_binding on protected systems; readback schemas - schemaguard implements maxItems - T05 added: informed-decision needs an application.access rule over realm-level claims (its lifecycle rules read authentication_audience) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
53 lines
1.2 KiB
Markdown
53 lines
1.2 KiB
Markdown
---
|
|
id: testdata.demo-app
|
|
name: readback test package demo-app
|
|
namespace: testdata:demo-app
|
|
version: v1
|
|
status: fixture
|
|
package: flexauth.testdata.demo_app
|
|
actions:
|
|
- application.access
|
|
- read
|
|
owner: team:platform-security
|
|
fixtures:
|
|
- policy_fixtures.yaml
|
|
caring:
|
|
profile: caring-0.4.0-rc2
|
|
enforce: false
|
|
canonical_roles: [Operator]
|
|
organization_relations: [ServiceProvider]
|
|
scopes:
|
|
- {level: Platform, id: platform:testdata, tenant: tenant:platform}
|
|
planes: [Identity]
|
|
capabilities: [Use]
|
|
exposure_modes: [Metadata]
|
|
conditions: [Logged]
|
|
restrictions: [PrivilegeEscalationBlocked]
|
|
---
|
|
|
|
# Readback test package (FLEX-WP-0035)
|
|
|
|
Test-only. Do not copy.
|
|
|
|
```rego
|
|
import future.keywords.if
|
|
import future.keywords.in
|
|
|
|
default decision := {"effect": "deny", "reason": "no_matching_rule"}
|
|
|
|
decision := {"effect": "allow", "reason": "app_user"} if {
|
|
input.action == "application.access"
|
|
"app-users" in input.subject.attributes.groups
|
|
input.subject.attributes.assurance.mfa == true
|
|
}
|
|
```
|
|
|
|
```rego test
|
|
package flexauth.testdata.demo_app_test
|
|
import future.keywords.if
|
|
import data.flexauth.testdata.demo_app
|
|
|
|
test_default_deny if {
|
|
demo_app.decision.effect == "deny" with input as {"action": "read", "subject": {"attributes": {}}}
|
|
}
|
|
```
|