flex-auth/examples/tenant-engine/subject_manifest.yaml

id: subjects:tenant-engine-operators
tenants:
  - id: tenant:platform
    name: Platform Tenant
subjects:
  - id: tenant-engine
    type: Service
    display_name: tenant-engine service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:tenant-engine-writers
    tenant: tenant:platform
    metadata:
      description: >-
        tenant-engine's own service identity, used for the tenant.create /
        tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions
        it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer).
groups:
  - id: group:tenant-engine-writers
    display_name: tenant-engine Write API Callers
    members:
      - tenant-engine
    tenant: tenant:platform
FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions (tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign) matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping exactly. No resource_manifest.yaml -- tenant-engine's resources are created dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented as a deliberate deviation. examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml (one registered caller: tenant-engine's own service identity), policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8 allow/deny pairs), assembled registry_snapshot.json, two standalone check_request examples, README. Design decision made explicit in the workplan: operator/service-identity authorization (one known subject, four known actions), not aal2+assurance + tenant-capability-role checking -- CheckRequest carries no assurance claim yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a real auth context), and a tenant's capability roles are the tenant's own state, not a property of who may call tenant-engine's admin API. Revisit once KEY-WP-0005 gives callers a real assurance-bearing identity. Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8 fixtures, all pass), load-registry, check against both example requests. Then ran a live flex-auth serve with this exact registry+policy and pointed tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test ./... still green across the whole repo. T03 (live-lookup context adapter for other protected systems) stays open -- new Go adapter package, tracked separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> 2026-07-23 23:05:57 +02:00			`id: subjects:tenant-engine-operators`
			`tenants:`
			`- id: tenant:platform`
			`name: Platform Tenant`
			`subjects:`
			`- id: tenant-engine`
			`type: Service`
			`display_name: tenant-engine service principal`
			`organization_relation: ServiceProvider`
			`roles:`
			`- Operator`
			`groups:`
			`- group:tenant-engine-writers`
			`tenant: tenant:platform`
			`metadata:`
			`description: >-`
			`tenant-engine's own service identity, used for the tenant.create /`
			`tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions`
			`it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer).`
			`groups:`
			`- id: group:tenant-engine-writers`
			`display_name: tenant-engine Write API Callers`
			`members:`
			`- tenant-engine`
			`tenant: tenant:platform`