coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cover wrong-tenant denials in ops-warden and railiance-platform fixtures.

Browse source 
FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture
suites never varied the field. No policy or version change. Asked
tenant-engine to name the CheckRequest tenant relation for T01/T02.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
tegwick 2026-09-15 23:38:48 +02:00
parent 6fd3a0cbc4
commit 0e020b2d8c
8 changed files with 117 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
examples/railiance-platform/check_request_deny_wrong_tenant.json Normal file
View file

@ -0,0 +1,21 @@
{
"id": "check:credential-grant-wrong-tenant-http-shape",
"tenant": "tenant:other",
"subject": {
"id": "agent:codex/railiance-platform",
"type": "Agent"
},
"action": "issue",
"resource": {
"id": "credential-grant:rapp-postgres/audit-core-runtime",
"type": "credential-grant",
"system": "railiance-platform"
},
"context": {
"actor_type": "approved-agent",
"bound_subject": "agent:codex/railiance-platform",
"purpose": "audit-core-runtime",
"delivery_mode": "exec-env",
"requested_ttl_seconds": 900
}
}