62 lines
2.4 KiB
YAML
62 lines
2.4 KiB
YAML
# Tenant governance validation fixtures (canon B11, G7, C14).
|
|
# Each case deep-merges `patch` over the valid base example and expects either no
|
|
# errors or an error containing `error`. A patch value of `~delete` removes the key.
|
|
platform_envelope: examples/platform-tenant-acme.yaml
|
|
base: examples/tenant-governance-acme.yaml
|
|
|
|
cases:
|
|
- name: the example self-governed envelope is valid
|
|
patch: {}
|
|
error: null
|
|
|
|
- name: auto mode with no restrictions is valid
|
|
patch: { mode: auto, restrictions: ~delete, human_decision_classes: ~delete }
|
|
error: null
|
|
|
|
- name: auto mode must not carry restrictions
|
|
patch: { mode: auto }
|
|
error: auto mode carries no restrictions
|
|
|
|
- name: a wider ceiling than the platform is rejected
|
|
patch: { restrictions: { ceilings: { blast_radius: platform } } }
|
|
error: "ceiling blast_radius=platform exceeds platform ceiling tenant"
|
|
|
|
- name: an unknown ceiling value is rejected
|
|
patch: { restrictions: { ceilings: { blast_radius: galaxy } } }
|
|
error: "unknown value for blast_radius"
|
|
|
|
- name: adding capabilities is rejected as widening
|
|
patch: { capabilities: [iam.change] }
|
|
error: "field not allowed: capabilities"
|
|
|
|
- name: adding delegations is rejected as widening
|
|
patch: { delegated: { iam.change: { mode: autonomous } } }
|
|
error: "field not allowed: delegated"
|
|
|
|
- name: removing platform prohibitions is rejected
|
|
patch: { restrictions: { remove_prohibitions: [deploy.public] } }
|
|
error: "restriction not allowed: remove_prohibitions"
|
|
|
|
- name: reserving a class outside platform capabilities is rejected
|
|
patch: { human_decision_classes: [iam.change] }
|
|
error: "human decision class outside platform capabilities: iam.change"
|
|
|
|
- name: auto-approve on deadline is rejected
|
|
patch: { on_deadline: auto_approve }
|
|
error: "on_deadline must be one of"
|
|
|
|
- name: an envelope bounded by another platform envelope is rejected
|
|
patch: { bounded_by: envelope://platform/tenant/other }
|
|
error: "bounded_by does not match"
|
|
|
|
- name: an envelope for another tenant is rejected
|
|
patch: { tenant: tenant://other }
|
|
error: "tenant does not match"
|
|
|
|
- name: an agent cannot establish tenant governance
|
|
patch: { established_by: agent://acme/run-7 }
|
|
error: "established_by must be a human principal"
|
|
|
|
- name: an unknown mode is rejected
|
|
patch: { mode: anarchy }
|
|
error: "mode must be one of"
|