111 lines
3.5 KiB
JSON
111 lines
3.5 KiB
JSON
|
{
|
||
|
|
"id": "decision:49309356905a2ad3",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"request_id": "check:secrets-engine-rotate",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v1",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "lane:glas-primary",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [],
|
||
|
|
"fields": [
|
||
|
|
"password"
|
||
|
|
],
|
||
|
|
"policy_targets": [],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "rotate",
|
||
|
|
"resource": {
|
||
|
|
"id": "lane:glas-primary",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [],
|
||
|
|
"fields": [
|
||
|
|
"password"
|
||
|
|
],
|
||
|
|
"policy_targets": [],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:de67324f54187055307a833235f83ced9fcd3a20952a27b3d19493ed39734345"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-06T06:13:21Z",
|
||
|
|
"expires_at": "2026-09-06T06:28:21Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "rotate",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v1",
|
||
|
|
"policy_package_digest": "sha256:fe0070b79f66442ae6c218697a49c470c6c8f670aa57a30c078a5284d097bd8c",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"decision_time": "2026-09-06T06:13:21Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|