85 lines
4.4 KiB
YAML
85 lines
4.4 KiB
YAML
# Decision fixtures inside a tenant (canon A3 steps 2, 4, 5, 8, 9; C14; G7).
|
|
# Paths under context are relative to envelopes/.
|
|
context:
|
|
platform_envelope: examples/platform-tenant-acme.yaml
|
|
defaults:
|
|
request:
|
|
request_id: req-tenant
|
|
principal: agent://acme/run-7
|
|
scope: { level: L0, temperature: warm, phase: build, tenant: tenant://acme, repository: acme/shop, environment: tenant-runtime }
|
|
risk: { blast_radius: repository, tenant_reach: own, data_sensitivity: internal, irreversible: false, external_exposure: none }
|
|
attributes: {}
|
|
evidence: []
|
|
|
|
cases:
|
|
# --- auto mode (no tenant governance) ------------------------------------------
|
|
- name: auto mode decides platform-delegated classes autonomously
|
|
request: { decision_class: code.edit }
|
|
expect: { outcome: AUTONOMOUS, source: envelope://platform/tenant/acme }
|
|
|
|
- name: auto mode deploy with evidence carries platform obligations
|
|
request: { decision_class: deploy.tenant_runtime, evidence: [tests, provenance] }
|
|
expect: { outcome: AUTONOMOUS_WITH_OBLIGATIONS, obligations: [record, verify_provenance] }
|
|
|
|
- name: auto mode deploy without evidence escalates to the platform
|
|
request: { decision_class: deploy.tenant_runtime, evidence: [tests] }
|
|
expect: { outcome: ESCALATE, blocking_condition: missing_evidence, route_to: platform, missing: [provenance] }
|
|
|
|
- name: a class outside platform capabilities escalates to the platform
|
|
request: { decision_class: iam.change }
|
|
expect: { outcome: ESCALATE, blocking_condition: outside_tenant_envelope, route_to: platform, rules: [C14] }
|
|
|
|
- name: risk above the platform ceiling is outside the tenant envelope
|
|
request: { decision_class: code.edit, risk: { blast_radius: platform } }
|
|
expect: { outcome: ESCALATE, blocking_condition: outside_tenant_envelope, route_to: platform }
|
|
|
|
- name: a platform prohibition is denied
|
|
request: { decision_class: deploy.public }
|
|
expect: { outcome: DENY, rules: [C14] }
|
|
|
|
- name: a capability the platform does not delegate escalates to the platform
|
|
request: { decision_class: data.tenant_own }
|
|
expect: { outcome: ESCALATE, blocking_condition: no_delegation, route_to: platform }
|
|
|
|
- name: the build-mode default envelope never applies inside a tenant
|
|
request: { decision_class: ci.add_check }
|
|
expect: { outcome: ESCALATE, blocking_condition: outside_tenant_envelope }
|
|
|
|
- name: constitutional denies still apply inside a tenant
|
|
request: { decision_class: tenant.platform_envelope_change }
|
|
expect: { outcome: DENY, rules: [C14] }
|
|
|
|
- name: crossing a tenant boundary is denied
|
|
request: { decision_class: tenant.cross }
|
|
expect: { outcome: DENY, rules: [C5] }
|
|
|
|
# --- self-governed mode ----------------------------------------------------------
|
|
- name: self-governed tenant reserves deploys for human decision
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: deploy.tenant_runtime, evidence: [tests, provenance] }
|
|
expect: { outcome: ESCALATE, blocking_condition: tenant_human_decision, route_to: tenant_admin }
|
|
|
|
- name: missing evidence is reported before asking the tenant human
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: deploy.tenant_runtime, evidence: [] }
|
|
expect: { outcome: ESCALATE, blocking_condition: missing_evidence }
|
|
|
|
- name: a tenant prohibition is denied
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: dependency.add, evidence: [lockfile_updated] }
|
|
expect: { outcome: DENY, rules: [P6] }
|
|
|
|
- name: a tighter tenant ceiling narrows the effective envelope
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: code.edit, risk: { blast_radius: tenant } }
|
|
expect: { outcome: ESCALATE, blocking_condition: risk, route_to: platform, missing: [blast_radius] }
|
|
|
|
- name: unrestricted classes still run on platform delegations
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: code.edit }
|
|
expect: { outcome: AUTONOMOUS }
|
|
|
|
- name: a tenant admin cannot pull a class outside the platform envelope inside
|
|
context: { tenant_governance: examples/tenant-governance-acme.yaml }
|
|
request: { decision_class: iam.change }
|
|
expect: { outcome: ESCALATE, blocking_condition: outside_tenant_envelope, route_to: platform }
|