flex-auth/examples/tenant-engine/protected_system_manifest.yaml

id: tenant-engine
name: Tenant Engine
resource_types:
  - name: tenant
    scope_level: Resource
    planes:
      - Identity
      - Audit
    metadata:
      description: A tenant record (existence, onboarding grouping).
  - name: role-grant
    scope_level: Resource
    planes:
      - Identity
      - Policy
      - Audit
    metadata:
      description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
  - name: plan-assignment
    scope_level: Resource
    planes:
      - Identity
      - Audit
    metadata:
      description: A tenant's plan/subscription assignment (by reference id).
actions:
  - name: tenant.create
    capabilities:
      - Create
      - Audit
    planes:
      - Identity
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.role.grant
    capabilities:
      - Grant
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.role.revoke
    capabilities:
      - Revoke
      - Audit
    planes:
      - Identity
      - Policy
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
  - name: tenant.plan.assign
    capabilities:
      - Bind
      - Audit
    planes:
      - Identity
      - Audit
    exposure_modes:
      - Metadata
    metadata:
      required_context: []
caring_profiles:
  - caring-0.4.0-rc2
metadata:
  flex_auth_contract: protected-system-v0
  boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md
FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions (tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign) matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping exactly. No resource_manifest.yaml -- tenant-engine's resources are created dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented as a deliberate deviation. examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml (one registered caller: tenant-engine's own service identity), policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8 allow/deny pairs), assembled registry_snapshot.json, two standalone check_request examples, README. Design decision made explicit in the workplan: operator/service-identity authorization (one known subject, four known actions), not aal2+assurance + tenant-capability-role checking -- CheckRequest carries no assurance claim yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a real auth context), and a tenant's capability roles are the tenant's own state, not a property of who may call tenant-engine's admin API. Revisit once KEY-WP-0005 gives callers a real assurance-bearing identity. Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8 fixtures, all pass), load-registry, check against both example requests. Then ran a live flex-auth serve with this exact registry+policy and pointed tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test ./... still green across the whole repo. T03 (live-lookup context adapter for other protected systems) stays open -- new Go adapter package, tracked separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> 2026-07-23 23:05:57 +02:00			`id: tenant-engine`
			`name: Tenant Engine`
			`resource_types:`
			`- name: tenant`
			`scope_level: Resource`
			`planes:`
			`- Identity`
			`- Audit`
			`metadata:`
			`description: A tenant record (existence, onboarding grouping).`
			`- name: role-grant`
			`scope_level: Resource`
			`planes:`
			`- Identity`
			`- Policy`
			`- Audit`
			`metadata:`
			`description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).`
			`- name: plan-assignment`
			`scope_level: Resource`
			`planes:`
			`- Identity`
			`- Audit`
			`metadata:`
			`description: A tenant's plan/subscription assignment (by reference id).`
			`actions:`
			`- name: tenant.create`
			`capabilities:`
			`- Create`
			`- Audit`
			`planes:`
			`- Identity`
			`- Audit`
			`exposure_modes:`
			`- Metadata`
			`metadata:`
			`required_context: []`
			`- name: tenant.role.grant`
			`capabilities:`
			`- Grant`
			`- Audit`
			`planes:`
			`- Identity`
			`- Policy`
			`- Audit`
			`exposure_modes:`
			`- Metadata`
			`metadata:`
			`required_context: []`
			`- name: tenant.role.revoke`
			`capabilities:`
			`- Revoke`
			`- Audit`
			`planes:`
			`- Identity`
			`- Policy`
			`- Audit`
			`exposure_modes:`
			`- Metadata`
			`metadata:`
			`required_context: []`
			`- name: tenant.plan.assign`
			`capabilities:`
			`- Bind`
			`- Audit`
			`planes:`
			`- Identity`
			`- Audit`
			`exposure_modes:`
			`- Metadata`
			`metadata:`
			`required_context: []`
			`caring_profiles:`
			`- caring-0.4.0-rc2`
			`metadata:`
			`flex_auth_contract: protected-system-v0`
			`boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`