tegwick
bbe8c15494
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
#
|
|
# The overlay only ever applies to a sender the Secret already carries, so an
|
|
# entry here for a sender with no token yet is inert. That is what makes the
|
|
# approval-engine entry safe to land ahead of its credential.
|
|
#
|
|
# evidence_kind may be raised here (attributive -> load-bearing) but never
|
|
# lowered: a ConfigMap refresh must not be able to drop a source's §9.6
|
|
# atomicity and detection obligations without anyone deciding to.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": ["user-engine"],
|
|
"tenants": ["*"],
|
|
"may_write": true,
|
|
"may_read": false
|
|
},
|
|
{
|
|
"name": "approval-engine",
|
|
"sources": ["approval-engine"],
|
|
"tenants": ["tenant:platform"],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"evidence_kind": "load-bearing"
|
|
}
|
|
]
|