FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.
examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.
Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.
Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.
T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 23:05:57 +02:00
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-create-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-create-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.create",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-role-grant-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-role-grant-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.role.grant",
|
|
|
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-role-revoke-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-role-revoke-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.role.revoke",
|
|
|
|
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-plan-assign-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-plan-assign-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.plan.assign",
|
|
|
|
|
"resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
Authorize tenant-engine lifecycle actions (FLEX-WP-0010)
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.
- policy_package.md: three actions in valid_actions and frontmatter;
CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
guards (tenant.retired, tenant_update -> unknown_action)
T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.
Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).
Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-update-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-update-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.update",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-retire-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-retire-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.retire",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-reactivate-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-reactivate-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.reactivate",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-update-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-update-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
|
|
|
"action": "tenant.update",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-retire-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-retire-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
|
|
|
"action": "tenant.retire",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-reactivate-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-reactivate-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
|
|
|
"action": "tenant.reactivate",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-misspelled-lifecycle-action-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-retired-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.retired",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-lifecycle-underscore-action-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-underscore-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant_update",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
|
|
|
},
|
FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.
examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.
Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.
Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.
T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 23:05:57 +02:00
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-create-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "some-other-service", "type": "service"},
|
|
|
|
|
"action": "tenant.create",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-wrong-system-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-create-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.create",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "wrong_system"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-unknown-action-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-delete-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.delete",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-wrong-subject-type-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-create-t1",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "human"},
|
|
|
|
|
"action": "tenant.create",
|
|
|
|
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
|
2026-08-16 02:46:25 +02:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-read-pdp-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-read-pdp",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.read",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-read-writer-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-read-writer",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.read",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-set-writer-allow",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-set-writer",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "tenant-engine", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.set",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-set-pdp-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-set-pdp",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.set",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "action_not_granted"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-read-ops",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "ops", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.read",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-set-ops",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "ops", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.set",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
|
|
|
|
|
"request": {
|
|
|
|
|
"id": "check:tenant-engine-guardrail-get",
|
|
|
|
|
"tenant": "tenant:friendly:binky",
|
|
|
|
|
"subject": {"id": "flex-auth", "type": "service"},
|
|
|
|
|
"action": "tenant.guardrail.get",
|
|
|
|
|
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
|
|
|
|
"context": {}
|
|
|
|
|
},
|
|
|
|
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.
examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.
Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.
Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.
T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 23:05:57 +02:00
|
|
|
}
|
|
|
|
|
]
|