flex-auth/examples/secrets-engine/protected_system_manifest.yaml

id: secrets-engine
name: Secrets Engine
resource_types:
  - name: secret-catalog-lane
    scope_level: Resource
    planes:
      - Secret
      - Policy
      - Audit
    metadata:
      description: >-
        A secret catalog lane: one catalog entry's delivery path at a given
        stage. The catalog id is resource.id; stage plus sorted fields,
        policy_targets, and auth_targets are resource.attributes.
        flex-auth never sees secret material, only the lane's coordinates.
actions:
  - name: apply
    capabilities: [EditAny, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
      note: >-
        apply --dry-run never reaches the gate, but the distinction is
        invisible here; both would arrive as "apply".
  - name: provision
    capabilities: [Create, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: rotate
    capabilities: [EditAny, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: verify
    capabilities: [View, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: handoff
    capabilities: [EditAny, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: wrap
    capabilities: [Execute, Audit]
    planes: [Secret, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: exec
    capabilities: [Execute, Audit]
    planes: [Secret, Execution, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: deactivate
    capabilities: [Archive, Audit]
    planes: [Secret, Policy, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
      note: >-
        Reached from both the CLI verb "revoke" and "lifecycle deactivate".
        There is no "revoke" action value.
  - name: suspend
    capabilities: [Archive, Audit]
    planes: [Secret, Policy, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
  - name: destroy
    capabilities: [DeleteAny, Audit]
    planes: [Secret, Policy, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context:
        - approval
      note: >-
        Dual control. Defined but not reachable live: the handler raises
        before the gate, so only --dry-run renders until SECRETS-WP-0007-T04.
  - name: compromise
    capabilities: [EditAny, Audit]
    planes: [Policy, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
      note: Mutates local delivery overlay state only; touches no OpenBao object.
  - name: reactivate
    capabilities: [Restore, Audit]
    planes: [Policy, Audit]
    exposure_modes: [Metadata]
    metadata:
      required_context: []
      note: Mutates local delivery overlay state only; touches no OpenBao object.
caring_profiles:
  - caring-0.4.0-rc2
metadata:
  flex_auth_contract: protected-system-v0
  action_vocabulary_source: secrets-engine docs/gated-actions.md (FLEX-WP-0021-T01)