FLEX-WP-0006: implement ops-warden signing gate policy

2026-06-23 21:17:42 +02:00 · 2026-06-23 21:17:42 +02:00 · 0fde95a87c
commit 0fde95a87c
parent 53e0d055c9
25 changed files with 1796 additions and 10 deletions
--- a/examples/ops-warden/protected_system_manifest.yaml
+++ b/examples/ops-warden/protected_system_manifest.yaml
@ -0,0 +1,36 @@
+id: ops-warden
+name: Ops Warden
+resource_types:
+  - name: ssh-certificate
+    scope_level: Resource
+    planes:
+      - Identity
+      - Secret
+      - Audit
+    metadata:
+      description: Short-lived SSH certificate signing request.
+actions:
+  - name: sign
+    capabilities:
+      - Use
+      - Operate
+      - Audit
+    planes:
+      - Identity
+      - Secret
+      - Audit
+    exposure_modes:
+      - Metadata
+    metadata:
+      required_context:
+        - principals
+        - actor_type
+        - pubkey_fingerprint
+        - ttl_hours
+caring_profiles:
+  - caring-0.4.0-rc2
+metadata:
+  flex_auth_contract: protected-system-v0
+  ops_warden_policy_gate: v2
+  policy_enabled_config: policy.enabled
+  tenant: tenant:platform