flex-auth/examples/tenant-engine/check_request_allow_retire.json

{
  "id": "check:tenant-engine-retire-t1",
  "tenant": "tenant:friendly:binky",
  "subject": {
    "id": "tenant-engine",
    "type": "service"
  },
  "action": "tenant.retire",
  "resource": {
    "id": "t-1",
    "type": "tenant",
    "system": "tenant-engine"
  },
  "context": {}
}
Authorize tenant-engine lifecycle actions (FLEX-WP-0010) Extend the tenant-engine write-API policy package with tenant.update, tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005 introduced. Until now every lifecycle mutation resolved to deny unknown_action, blocking TEN-WP-0005-T05 production rollout. - policy_package.md: three actions in valid_actions and frontmatter; CARING capabilities extended with EditAny/Archive/Restore - protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt registry_snapshot.json carry all seven actions - docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces - 8 new fixture pairs and 5 new Rego tests, including action-drift guards (tenant.retired, tenant_update -> unknown_action) T02 decision, recorded in policy_package.md: tenant.retire does NOT get stricter authorization yet. With one service subject and no assurance claim in the CheckRequest there is nothing stricter to check, and a condition the sole caller always satisfies would falsely read as separate control. Retirement is reversible and non-destructive. Revisit on KEY-WP-0005 assurance claims or a second operator subject. Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt and go vet clean. End-to-end against a live serve with a real tenant-engine through the unmodified FlexAuthWriteAuthorizer: update 6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970 all allow; unregistered actor denied unknown_subject (59d3e99c6416be89, 403 write_denied). Handoff revision for TEN-WP-0005-T05: package tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-10 20:52:10 +02:00			`{`
			`"id": "check:tenant-engine-retire-t1",`
			`"tenant": "tenant:friendly:binky",`
			`"subject": {`
			`"id": "tenant-engine",`
			`"type": "service"`
			`},`
			`"action": "tenant.retire",`
			`"resource": {`
			`"id": "t-1",`
			`"type": "tenant",`
			`"system": "tenant-engine"`
			`},`
			`"context": {}`
			`}`