# flex-auth vocabulary — coulomb.social

Protected system id: `coulomb-social` (`FLEX_AUTH_PROTECTED_SYSTEM_ID`).

## Actions (v0 shell)

| Action | Resource type | Resource id | Effect (local mode) |
|--------|---------------|-------------|---------------------|
| `shell:view` | `shell` | e.g. `app_home` | allow if authenticated |
| `member:self:read` | `member` | OIDC `sub` | allow if subject == resource id |
| `member:admin` | `member` | any | deny (until policy package) |

## Runtime modes

| `FLEX_AUTH_BASE_URL` | Behavior |
|----------------------|----------|
| empty | local vocabulary above |
| set | `POST {base}/v1/check` (schema: flex-auth `check_request.schema.json`); fail-closed on error |

## Cluster status (2026-08-09)

Only `flex-auth-tenant-engine` is running in-cluster; a general flex-auth
check Service for app PEPs is **not** yet the S5 default for coulomb.social.
Until that lands, leave `FLEX_AUTH_BASE_URL` empty (local mode) or point at a
dev PDP.

## Future policy package

When registering with flex-auth / Topaz:

- system: `coulomb-social`
- package: allow `shell:view` for principals with a valid platform session
- package: allow `member:self:read` when subject id matches resource id
- deny-by-default otherwise

See `flex-auth/schemas/protected_system_manifest.schema.json`.