# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
# audit-core-senders. This ConfigMap is the authority for tenants/sources
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
# Keep in lockstep with deploy/senders-scope.json.
#
# The overlay only ever applies to a sender the Secret already carries, so an
# entry here for a sender with no token yet is inert. That is what makes the
# approval-engine entry safe to land ahead of its credential.
#
# evidence_kind may be raised here (attributive -> load-bearing) but never
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
# atomicity and detection obligations without anyone deciding to.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: audit-core-senders-scope
  namespace: audit-core
  labels:
    app.kubernetes.io/name: audit-core
data:
  senders-scope.json: |
    [
      {
        "name": "user-engine",
        "sources": ["user-engine"],
        "tenants": ["*"],
        "may_write": true,
        "may_read": false
      },
      {
        "name": "approval-engine",
        "sources": ["approval-engine"],
        "tenants": ["tenant:platform"],
        "may_write": true,
        "may_read": false,
        "evidence_kind": "load-bearing"
      }
    ]