flex-auth/internal/policy/testdata/undeclared-ceiling/policy_fixtures.yaml

- id: fixture:undeclared-ceiling-allow
  request:
    subject:
      id: user:alice
    action: sign
    resource:
      id: secret:example
      attributes:
        max_ttl_hours: 8
    context:
      ttl_hours: 1
  expect:
    effect: allow
    reason: ttl_ok
Make undeclared policy attribute reads a validate error. FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that no sibling registry or manifest supplies. A broken testdata package proves tests can pass while the ceiling remains caller-only. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 2026-09-14 09:54:09 +02:00			`- id: fixture:undeclared-ceiling-allow`
			`request:`
			`subject:`
			`id: user:alice`
			`action: sign`
			`resource:`
			`id: secret:example`
			`attributes:`
			`max_ttl_hours: 8`
			`context:`
			`ttl_hours: 1`
			`expect:`
			`effect: allow`
			`reason: ttl_ok`