60 lines
2.2 KiB
YAML
60 lines
2.2 KiB
YAML
|
- id: fixture:credential-grant-allow
|
||
|
|
request: &allow_request
|
||
|
|
id: check:credential-grant-allow
|
||
|
|
tenant: tenant:platform
|
||
|
|
subject: {id: agent:codex/railiance-platform, type: Agent}
|
||
|
|
action: issue
|
||
|
|
resource:
|
||
|
|
id: credential-grant:rapp-postgres/audit-core-runtime
|
||
|
|
type: credential-grant
|
||
|
|
system: railiance-platform
|
||
|
|
attributes:
|
||
|
|
grant_id: rapp-postgres/audit-core-runtime
|
||
|
|
credential_type: openbao-database-credential
|
||
|
|
issuer: openbao
|
||
|
|
audience: audit-core
|
||
|
|
max_ttl_seconds: 3600
|
||
|
|
allowed_actor_types: [human-operator, approved-agent, ci-runner]
|
||
|
|
allowed_purposes: [audit-core-runtime]
|
||
|
|
allowed_delivery_modes: [exec-env]
|
||
|
|
context: &allow_context
|
||
|
|
actor_type: approved-agent
|
||
|
|
bound_subject: agent:codex/railiance-platform
|
||
|
|
purpose: audit-core-runtime
|
||
|
|
delivery_mode: exec-env
|
||
|
|
requested_ttl_seconds: 900
|
||
|
|
expect: {effect: allow, reason: credential_grant_allowed}
|
||
|
|
- id: fixture:credential-grant-ttl-deny
|
||
|
|
request:
|
||
|
|
<<: *allow_request
|
||
|
|
id: check:credential-grant-ttl-deny
|
||
|
|
context: {<<: *allow_context, requested_ttl_seconds: 5400}
|
||
|
|
expect: {effect: deny, reason: ttl_out_of_bounds}
|
||
|
|
- id: fixture:credential-grant-actor-type-deny
|
||
|
|
request:
|
||
|
|
<<: *allow_request
|
||
|
|
id: check:credential-grant-actor-deny
|
||
|
|
context: {<<: *allow_context, actor_type: unapproved-agent}
|
||
|
|
expect: {effect: deny, reason: actor_type_not_allowed}
|
||
|
|
- id: fixture:credential-grant-purpose-deny
|
||
|
|
request:
|
||
|
|
<<: *allow_request
|
||
|
|
id: check:credential-grant-purpose-deny
|
||
|
|
context: {<<: *allow_context, purpose: unrelated-purpose}
|
||
|
|
expect: {effect: deny, reason: purpose_not_allowed}
|
||
|
|
- id: fixture:credential-grant-delivery-deny
|
||
|
|
request:
|
||
|
|
<<: *allow_request
|
||
|
|
id: check:credential-grant-delivery-deny
|
||
|
|
context: {<<: *allow_context, delivery_mode: chat}
|
||
|
|
expect: {effect: deny, reason: delivery_mode_not_allowed}
|
||
|
|
- id: fixture:credential-grant-unknown-deny
|
||
|
|
request:
|
||
|
|
<<: *allow_request
|
||
|
|
id: check:credential-grant-unknown-deny
|
||
|
|
resource:
|
||
|
|
id: credential-grant:unknown/grant
|
||
|
|
type: credential-grant
|
||
|
|
system: railiance-platform
|
||
|
|
expect: {effect: deny, reason: unknown_grant}
|