FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.
examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.
Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.
Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.
T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
parent
ab0125193f
commit
49de2f40ff
11 changed files with 744 additions and 2 deletions
36
docs/tenant-engine-action-vocabulary.md
Normal file
36
docs/tenant-engine-action-vocabulary.md
Normal file
|
|
@ -0,0 +1,36 @@
|
||||||
|
# tenant-engine Action Vocabulary
|
||||||
|
|
||||||
|
This document defines the action vocabulary for `tenant-engine` as a
|
||||||
|
flex-auth protected system (`FLEX-WP-0008-T01`). Action names here match
|
||||||
|
`tenant-engine`'s own `authz.FlexAuthWriteAuthorizer` mapping exactly
|
||||||
|
(`tenant_engine/src/tenant_engine/authz.py`) — coordinated between the two
|
||||||
|
repos, not independently invented.
|
||||||
|
|
||||||
|
| Action | tenant-engine write endpoint | Resource type | Decision effects |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| `tenant.create` | `POST /tenants` | `tenant` | `allow`, `deny` |
|
||||||
|
| `tenant.role.grant` | `POST /tenants/{id}/roles/grant` | `role-grant` | `allow`, `deny` |
|
||||||
|
| `tenant.role.revoke` | `POST /tenants/{id}/roles/revoke` | `role-grant` | `allow`, `deny` |
|
||||||
|
| `tenant.plan.assign` | `POST /tenants/{id}/plan` | `plan-assignment` | `allow`, `deny` |
|
||||||
|
|
||||||
|
These are the only four actions `tenant-engine` sends to `POST /v1/check` —
|
||||||
|
its `FlexAuthCheckClient` (`TEN-WP-0003`) never sends anything else, and
|
||||||
|
`tenant-engine`'s reads (`/roles`, `/roles/live`) are never gated through
|
||||||
|
flex-auth at all; they're `tenant-engine`'s own cache-read and live-lookup
|
||||||
|
endpoints, consumed *by* `key-cape` and `flex-auth` respectively.
|
||||||
|
|
||||||
|
## Not in scope for this vocabulary
|
||||||
|
|
||||||
|
`tenant-engine`'s capability roles (`PLTF`/`IAM`/`VEN`/`CUS`, ADR-0014) are
|
||||||
|
**tenant** state — what a tenant is allowed to do on the platform. This
|
||||||
|
vocabulary governs a different question: which **operator/service
|
||||||
|
subjects** are allowed to call `tenant-engine`'s admin API at all. The two
|
||||||
|
must not be conflated — a policy package that checked a *caller's* action
|
||||||
|
against a *tenant's* capability roles would be checking the wrong thing.
|
||||||
|
See `examples/tenant-engine/policy_package.md`'s Rules section for how the
|
||||||
|
distinction is enforced.
|
||||||
|
|
||||||
|
## Related
|
||||||
|
|
||||||
|
- `docs/tenant-engine-resource-namespace.md`
|
||||||
|
- `examples/tenant-engine/`
|
||||||
45
docs/tenant-engine-resource-namespace.md
Normal file
45
docs/tenant-engine-resource-namespace.md
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
# tenant-engine Resource Namespace
|
||||||
|
|
||||||
|
This document defines the `tenant-engine` protected-system namespace
|
||||||
|
consumed by flex-auth (`FLEX-WP-0008-T01`).
|
||||||
|
|
||||||
|
Unlike Markitect's document hierarchy or ops-warden's fixed SSH-certificate
|
||||||
|
inventory, `tenant-engine`'s resources (tenants, their role grants, their
|
||||||
|
plan assignments) are created **dynamically** — there is no fixed,
|
||||||
|
pre-registrable resource list to publish a `resource_manifest.yaml` for.
|
||||||
|
Every `CheckRequest` carries the resource identity inline
|
||||||
|
(`resource.id == tenant_id`), and the policy evaluates against `input`
|
||||||
|
directly rather than looking up a registered resource by id. This is a
|
||||||
|
deliberate, documented deviation from the ops-warden pattern, not an
|
||||||
|
omission.
|
||||||
|
|
||||||
|
## Resource Types
|
||||||
|
|
||||||
|
```text
|
||||||
|
tenant -- a tenant record (existence, grouping)
|
||||||
|
role-grant -- a capability-role grant/revocation
|
||||||
|
plan-assignment -- a tenant's plan/subscription assignment
|
||||||
|
```
|
||||||
|
|
||||||
|
All three are `scope_level: Resource`, always accessed within
|
||||||
|
`system: tenant-engine`.
|
||||||
|
|
||||||
|
## Ownership Boundary
|
||||||
|
|
||||||
|
`tenant-engine`'s own boundary contract
|
||||||
|
(`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`)
|
||||||
|
already defines these as `tenant-engine`'s owned resource kinds. This
|
||||||
|
namespace only maps that ownership into flex-auth's protected-system
|
||||||
|
vocabulary — it does not redefine ownership.
|
||||||
|
|
||||||
|
## Related
|
||||||
|
|
||||||
|
- `docs/tenant-engine-action-vocabulary.md` — the actions gated on these
|
||||||
|
resource types
|
||||||
|
- `examples/tenant-engine/` — protected-system manifest, subject manifest,
|
||||||
|
policy package, and fixtures
|
||||||
|
- `net-kingdom/docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md`
|
||||||
|
— the capability-role model (`PLTF`/`IAM`/`VEN`/`CUS`) these resources
|
||||||
|
carry as *tenant* state, distinct from the *operator* authorization this
|
||||||
|
namespace governs (who may call `tenant-engine`'s write API, not what a
|
||||||
|
tenant is allowed to do)
|
||||||
58
examples/tenant-engine/README.md
Normal file
58
examples/tenant-engine/README.md
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
# tenant-engine Consumer Integration Fixtures
|
||||||
|
|
||||||
|
`FLEX-WP-0008-T01`/`T02`. Registers `tenant-engine` as a flex-auth
|
||||||
|
protected-system consumer, gating its own write API
|
||||||
|
(`TEN-WP-0003`'s `authz.FlexAuthWriteAuthorizer`).
|
||||||
|
|
||||||
|
## Files
|
||||||
|
|
||||||
|
| File | Purpose |
|
||||||
|
| --- | --- |
|
||||||
|
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`) and actions (`tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, `tenant.plan.assign`) |
|
||||||
|
| `subject_manifest.yaml` | The one registered caller: `tenant-engine`'s own service identity |
|
||||||
|
| `policy_package.md` | Rego rules + embedded tests gating the write API |
|
||||||
|
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
|
||||||
|
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
|
||||||
|
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json` | Standalone example requests for `flex-auth check` |
|
||||||
|
|
||||||
|
**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
|
||||||
|
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
|
||||||
|
See `docs/tenant-engine-resource-namespace.md` for why that's a deliberate
|
||||||
|
omission, not an oversight.
|
||||||
|
|
||||||
|
## Verified
|
||||||
|
|
||||||
|
```bash
|
||||||
|
go build -o bin/flex-auth ./cmd/flex-auth
|
||||||
|
|
||||||
|
# Rego rules + embedded tests + fixtures, all pass:
|
||||||
|
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md
|
||||||
|
|
||||||
|
# Registry loads cleanly:
|
||||||
|
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json
|
||||||
|
|
||||||
|
# Individual requests via the CLI:
|
||||||
|
bin/flex-auth check \
|
||||||
|
-registry examples/tenant-engine/registry_snapshot.json \
|
||||||
|
-policy examples/tenant-engine/policy_package.md \
|
||||||
|
-request examples/tenant-engine/check_request_allow_create.json
|
||||||
|
|
||||||
|
# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
|
||||||
|
# exact registry+policy, hit by tenant-engine's actual
|
||||||
|
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
|
||||||
|
# POST /tenants with actor="ops" -> 403 (unknown_subject);
|
||||||
|
# actor="tenant-engine" -> 201 (write_api_policy_matched).
|
||||||
|
bin/flex-auth serve -addr 127.0.0.1:9098 \
|
||||||
|
-registry examples/tenant-engine/registry_snapshot.json \
|
||||||
|
-policy examples/tenant-engine/policy_package.md
|
||||||
|
# (from tenant-engine's own checkout)
|
||||||
|
TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
|
||||||
|
```
|
||||||
|
|
||||||
|
## Related
|
||||||
|
|
||||||
|
- `docs/tenant-engine-resource-namespace.md`
|
||||||
|
- `docs/tenant-engine-action-vocabulary.md`
|
||||||
|
- `tenant-engine/docs/flex-auth-integration.md` — the client side of this
|
||||||
|
integration
|
||||||
|
- `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`
|
||||||
15
examples/tenant-engine/check_request_allow_create.json
Normal file
15
examples/tenant-engine/check_request_allow_create.json
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
{
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {
|
||||||
|
"id": "tenant-engine",
|
||||||
|
"type": "service"
|
||||||
|
},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {
|
||||||
|
"id": "t-1",
|
||||||
|
"type": "tenant",
|
||||||
|
"system": "tenant-engine"
|
||||||
|
},
|
||||||
|
"context": {}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
{
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {
|
||||||
|
"id": "some-other-service",
|
||||||
|
"type": "service"
|
||||||
|
},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {
|
||||||
|
"id": "t-1",
|
||||||
|
"type": "tenant",
|
||||||
|
"system": "tenant-engine"
|
||||||
|
},
|
||||||
|
"context": {}
|
||||||
|
}
|
||||||
98
examples/tenant-engine/policy_fixtures.yaml
Normal file
98
examples/tenant-engine/policy_fixtures.yaml
Normal file
|
|
@ -0,0 +1,98 @@
|
||||||
|
[
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-create-allow",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-role-grant-allow",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-role-grant-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.role.grant",
|
||||||
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-role-revoke-allow",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-role-revoke-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.role.revoke",
|
||||||
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-plan-assign-allow",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-plan-assign-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.plan.assign",
|
||||||
|
"resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-unknown-subject-deny",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "some-other-service", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-wrong-system-deny",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "deny", "reason": "wrong_system"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-unknown-action-deny",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-delete-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.delete",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "deny", "reason": "unknown_action"}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "fixture:tenant-engine-wrong-subject-type-deny",
|
||||||
|
"request": {
|
||||||
|
"id": "check:tenant-engine-create-t1",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "human"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
|
||||||
|
"context": {}
|
||||||
|
},
|
||||||
|
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
|
||||||
|
}
|
||||||
|
]
|
||||||
165
examples/tenant-engine/policy_package.md
Normal file
165
examples/tenant-engine/policy_package.md
Normal file
|
|
@ -0,0 +1,165 @@
|
||||||
|
---
|
||||||
|
id: tenant-engine.write-api.mutate
|
||||||
|
name: tenant-engine Write API authorization
|
||||||
|
namespace: tenant-engine:tenant
|
||||||
|
version: v1
|
||||||
|
status: ready
|
||||||
|
package: flexauth.tenant_engine.write_api
|
||||||
|
actions:
|
||||||
|
- tenant.create
|
||||||
|
- tenant.role.grant
|
||||||
|
- tenant.role.revoke
|
||||||
|
- tenant.plan.assign
|
||||||
|
owner: team:platform-security
|
||||||
|
fixtures:
|
||||||
|
- policy_fixtures.yaml
|
||||||
|
caring:
|
||||||
|
profile: caring-0.4.0-rc2
|
||||||
|
enforce: false
|
||||||
|
canonical_roles:
|
||||||
|
- Operator
|
||||||
|
organization_relations:
|
||||||
|
- ServiceProvider
|
||||||
|
scopes:
|
||||||
|
- level: Platform
|
||||||
|
id: platform:tenant-engine
|
||||||
|
tenant: tenant:platform
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Policy
|
||||||
|
- Audit
|
||||||
|
capabilities:
|
||||||
|
- Create
|
||||||
|
- Grant
|
||||||
|
- Revoke
|
||||||
|
- Bind
|
||||||
|
- Audit
|
||||||
|
exposure_modes:
|
||||||
|
- Metadata
|
||||||
|
conditions:
|
||||||
|
- Logged
|
||||||
|
restrictions:
|
||||||
|
- PrivilegeEscalationBlocked
|
||||||
|
activation:
|
||||||
|
mode: local
|
||||||
|
metadata:
|
||||||
|
source: examples/tenant-engine/policy_package.md
|
||||||
|
flex_auth_contract: protected-system-v0
|
||||||
|
---
|
||||||
|
|
||||||
|
# tenant-engine Write API authorization
|
||||||
|
|
||||||
|
This package authorizes `tenant-engine`'s write API
|
||||||
|
(`TEN-WP-0003`'s `authz.FlexAuthWriteAuthorizer`). `tenant-engine` keeps
|
||||||
|
custody of tenant records, role-grant audit trails, and plan assignments;
|
||||||
|
flex-auth decides whether a specific write is allowed now.
|
||||||
|
|
||||||
|
**Scope note:** this policy governs *who may call tenant-engine's admin
|
||||||
|
API* (an operator/service-identity question) — it does not evaluate a
|
||||||
|
*tenant's* capability roles (`PLTF`/`IAM`/`VEN`/`CUS`, ADR-0014). Those are
|
||||||
|
tenant state a *different* protected system's policy might consult via
|
||||||
|
`tenant-engine`'s live-lookup endpoint (`FLEX-WP-0008-T03`); conflating the
|
||||||
|
two would authorize the wrong thing.
|
||||||
|
|
||||||
|
## Rules
|
||||||
|
|
||||||
|
```rego
|
||||||
|
import future.keywords.contains
|
||||||
|
import future.keywords.if
|
||||||
|
import future.keywords.in
|
||||||
|
|
||||||
|
valid_actions := {
|
||||||
|
"tenant.create",
|
||||||
|
"tenant.role.grant",
|
||||||
|
"tenant.role.revoke",
|
||||||
|
"tenant.plan.assign",
|
||||||
|
}
|
||||||
|
|
||||||
|
known_operators := {"tenant-engine"}
|
||||||
|
|
||||||
|
decision := {"effect": "allow", "reason": "write_api_policy_matched"} if {
|
||||||
|
allowed
|
||||||
|
} else := {"effect": "deny", "reason": first_denial} if {
|
||||||
|
true
|
||||||
|
}
|
||||||
|
|
||||||
|
allowed if {
|
||||||
|
input.resource.system == "tenant-engine"
|
||||||
|
input.action in valid_actions
|
||||||
|
input.subject.type == "service"
|
||||||
|
input.subject.id in known_operators
|
||||||
|
}
|
||||||
|
|
||||||
|
default first_denial := "no_matching_rule"
|
||||||
|
|
||||||
|
first_denial := "wrong_system" if {
|
||||||
|
input.resource.system != "tenant-engine"
|
||||||
|
} else := "unknown_action" if {
|
||||||
|
not input.action in valid_actions
|
||||||
|
} else := "wrong_subject_type" if {
|
||||||
|
input.subject.type != "service"
|
||||||
|
} else := "unknown_subject" if {
|
||||||
|
not input.subject.id in known_operators
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Tests
|
||||||
|
|
||||||
|
```rego test
|
||||||
|
package flexauth.tenant_engine.write_api_test
|
||||||
|
|
||||||
|
import future.keywords.if
|
||||||
|
import data.flexauth.tenant_engine.write_api
|
||||||
|
|
||||||
|
base_request := {
|
||||||
|
"id": "check:tenant-engine-create",
|
||||||
|
"tenant": "tenant:friendly:binky",
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_known_operator_create_allowed if {
|
||||||
|
write_api.decision.effect == "allow" with input as base_request
|
||||||
|
}
|
||||||
|
|
||||||
|
test_role_grant_allowed if {
|
||||||
|
write_api.decision.effect == "allow" with input as {
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.role.grant",
|
||||||
|
"resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_unknown_subject_denied if {
|
||||||
|
write_api.decision.reason == "unknown_subject" with input as {
|
||||||
|
"subject": {"id": "some-other-service", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_wrong_system_denied if {
|
||||||
|
write_api.decision.reason == "wrong_system" with input as {
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_unknown_action_denied if {
|
||||||
|
write_api.decision.reason == "unknown_action" with input as {
|
||||||
|
"subject": {"id": "tenant-engine", "type": "service"},
|
||||||
|
"action": "tenant.delete",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test_wrong_subject_type_denied if {
|
||||||
|
write_api.decision.reason == "wrong_subject_type" with input as {
|
||||||
|
"subject": {"id": "tenant-engine", "type": "human"},
|
||||||
|
"action": "tenant.create",
|
||||||
|
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
77
examples/tenant-engine/protected_system_manifest.yaml
Normal file
77
examples/tenant-engine/protected_system_manifest.yaml
Normal file
|
|
@ -0,0 +1,77 @@
|
||||||
|
id: tenant-engine
|
||||||
|
name: Tenant Engine
|
||||||
|
resource_types:
|
||||||
|
- name: tenant
|
||||||
|
scope_level: Resource
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Audit
|
||||||
|
metadata:
|
||||||
|
description: A tenant record (existence, onboarding grouping).
|
||||||
|
- name: role-grant
|
||||||
|
scope_level: Resource
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Policy
|
||||||
|
- Audit
|
||||||
|
metadata:
|
||||||
|
description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
|
||||||
|
- name: plan-assignment
|
||||||
|
scope_level: Resource
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Audit
|
||||||
|
metadata:
|
||||||
|
description: A tenant's plan/subscription assignment (by reference id).
|
||||||
|
actions:
|
||||||
|
- name: tenant.create
|
||||||
|
capabilities:
|
||||||
|
- Create
|
||||||
|
- Audit
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Audit
|
||||||
|
exposure_modes:
|
||||||
|
- Metadata
|
||||||
|
metadata:
|
||||||
|
required_context: []
|
||||||
|
- name: tenant.role.grant
|
||||||
|
capabilities:
|
||||||
|
- Grant
|
||||||
|
- Audit
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Policy
|
||||||
|
- Audit
|
||||||
|
exposure_modes:
|
||||||
|
- Metadata
|
||||||
|
metadata:
|
||||||
|
required_context: []
|
||||||
|
- name: tenant.role.revoke
|
||||||
|
capabilities:
|
||||||
|
- Revoke
|
||||||
|
- Audit
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Policy
|
||||||
|
- Audit
|
||||||
|
exposure_modes:
|
||||||
|
- Metadata
|
||||||
|
metadata:
|
||||||
|
required_context: []
|
||||||
|
- name: tenant.plan.assign
|
||||||
|
capabilities:
|
||||||
|
- Bind
|
||||||
|
- Audit
|
||||||
|
planes:
|
||||||
|
- Identity
|
||||||
|
- Audit
|
||||||
|
exposure_modes:
|
||||||
|
- Metadata
|
||||||
|
metadata:
|
||||||
|
required_context: []
|
||||||
|
caring_profiles:
|
||||||
|
- caring-0.4.0-rc2
|
||||||
|
metadata:
|
||||||
|
flex_auth_contract: protected-system-v0
|
||||||
|
boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md
|
||||||
159
examples/tenant-engine/registry_snapshot.json
Normal file
159
examples/tenant-engine/registry_snapshot.json
Normal file
|
|
@ -0,0 +1,159 @@
|
||||||
|
{
|
||||||
|
"systems": [
|
||||||
|
{
|
||||||
|
"id": "tenant-engine",
|
||||||
|
"name": "Tenant Engine",
|
||||||
|
"resource_types": [
|
||||||
|
{
|
||||||
|
"name": "tenant",
|
||||||
|
"scope_level": "Resource",
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"description": "A tenant record (existence, onboarding grouping)."
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "role-grant",
|
||||||
|
"scope_level": "Resource",
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Policy",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "plan-assignment",
|
||||||
|
"scope_level": "Resource",
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"description": "A tenant's plan/subscription assignment (by reference id)."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"actions": [
|
||||||
|
{
|
||||||
|
"name": "tenant.create",
|
||||||
|
"capabilities": [
|
||||||
|
"Create",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"exposure_modes": [
|
||||||
|
"Metadata"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"required_context": []
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "tenant.role.grant",
|
||||||
|
"capabilities": [
|
||||||
|
"Grant",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Policy",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"exposure_modes": [
|
||||||
|
"Metadata"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"required_context": []
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "tenant.role.revoke",
|
||||||
|
"capabilities": [
|
||||||
|
"Revoke",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Policy",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"exposure_modes": [
|
||||||
|
"Metadata"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"required_context": []
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "tenant.plan.assign",
|
||||||
|
"capabilities": [
|
||||||
|
"Bind",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"planes": [
|
||||||
|
"Identity",
|
||||||
|
"Audit"
|
||||||
|
],
|
||||||
|
"exposure_modes": [
|
||||||
|
"Metadata"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"required_context": []
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"caring_profiles": [
|
||||||
|
"caring-0.4.0-rc2"
|
||||||
|
],
|
||||||
|
"metadata": {
|
||||||
|
"flex_auth_contract": "protected-system-v0",
|
||||||
|
"boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"resource_manifests": [],
|
||||||
|
"tenants": [
|
||||||
|
{
|
||||||
|
"id": "tenant:platform",
|
||||||
|
"name": "Platform Tenant"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"subjects": [
|
||||||
|
{
|
||||||
|
"id": "tenant-engine",
|
||||||
|
"type": "Service",
|
||||||
|
"display_name": "tenant-engine service principal",
|
||||||
|
"organization_relation": "ServiceProvider",
|
||||||
|
"roles": [
|
||||||
|
"Operator"
|
||||||
|
],
|
||||||
|
"groups": [
|
||||||
|
"group:tenant-engine-writers"
|
||||||
|
],
|
||||||
|
"tenant": "tenant:platform",
|
||||||
|
"metadata": {
|
||||||
|
"description": "tenant-engine's own service identity, used for the tenant.create / tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer)."
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"groups": [
|
||||||
|
{
|
||||||
|
"id": "group:tenant-engine-writers",
|
||||||
|
"display_name": "tenant-engine Write API Callers",
|
||||||
|
"members": [
|
||||||
|
"tenant-engine"
|
||||||
|
],
|
||||||
|
"tenant": "tenant:platform"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"relationships": []
|
||||||
|
}
|
||||||
25
examples/tenant-engine/subject_manifest.yaml
Normal file
25
examples/tenant-engine/subject_manifest.yaml
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
id: subjects:tenant-engine-operators
|
||||||
|
tenants:
|
||||||
|
- id: tenant:platform
|
||||||
|
name: Platform Tenant
|
||||||
|
subjects:
|
||||||
|
- id: tenant-engine
|
||||||
|
type: Service
|
||||||
|
display_name: tenant-engine service principal
|
||||||
|
organization_relation: ServiceProvider
|
||||||
|
roles:
|
||||||
|
- Operator
|
||||||
|
groups:
|
||||||
|
- group:tenant-engine-writers
|
||||||
|
tenant: tenant:platform
|
||||||
|
metadata:
|
||||||
|
description: >-
|
||||||
|
tenant-engine's own service identity, used for the tenant.create /
|
||||||
|
tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions
|
||||||
|
it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer).
|
||||||
|
groups:
|
||||||
|
- id: group:tenant-engine-writers
|
||||||
|
display_name: tenant-engine Write API Callers
|
||||||
|
members:
|
||||||
|
- tenant-engine
|
||||||
|
tenant: tenant:platform
|
||||||
|
|
@ -16,6 +16,7 @@ related_workplans:
|
||||||
- KEY-WP-0005
|
- KEY-WP-0005
|
||||||
created: "2026-07-23"
|
created: "2026-07-23"
|
||||||
updated: "2026-07-23"
|
updated: "2026-07-23"
|
||||||
|
state_hub_workstream_id: "6341d238-fffc-4428-9265-0b6db5714e9b"
|
||||||
---
|
---
|
||||||
|
|
||||||
# FLEX-WP-0008: tenant-engine Consumer Integration
|
# FLEX-WP-0008: tenant-engine Consumer Integration
|
||||||
|
|
@ -49,8 +50,9 @@ and action vocabulary is small and doesn't need CARING descriptor mapping.
|
||||||
|
|
||||||
```task
|
```task
|
||||||
id: FLEX-WP-0008-T01
|
id: FLEX-WP-0008-T01
|
||||||
status: todo
|
status: done
|
||||||
priority: high
|
priority: high
|
||||||
|
state_hub_task_id: "d78361e6-eb8e-4623-bed2-917538c403ca"
|
||||||
```
|
```
|
||||||
|
|
||||||
Resource types: `tenant`, `role-grant`, `plan-assignment`. Actions:
|
Resource types: `tenant`, `role-grant`, `plan-assignment`. Actions:
|
||||||
|
|
@ -66,12 +68,23 @@ the `markitect-resource-namespace.md` / `markitect-action-vocabulary.md`
|
||||||
naming pattern (`tenant-engine-resource-namespace.md`,
|
naming pattern (`tenant-engine-resource-namespace.md`,
|
||||||
`tenant-engine-action-vocabulary.md`).
|
`tenant-engine-action-vocabulary.md`).
|
||||||
|
|
||||||
|
**Done 2026-07-23:** Both docs written. One deliberate deviation from the
|
||||||
|
ops-warden template, documented in `tenant-engine-resource-namespace.md`:
|
||||||
|
no `resource_manifest.yaml` — ops-warden's SSH certificates are a fixed,
|
||||||
|
pre-registrable inventory; `tenant-engine`'s tenants are created
|
||||||
|
dynamically, so the policy evaluates `input` directly rather than looking
|
||||||
|
up a registered resource by id. Action vocabulary cross-checked against
|
||||||
|
`tenant-engine/src/tenant_engine/authz.py`'s actual
|
||||||
|
`_RESOURCE_TYPES` mapping — the four action strings and their resource
|
||||||
|
types match exactly, not just by convention.
|
||||||
|
|
||||||
## Task: Author and register the tenant-engine policy package
|
## Task: Author and register the tenant-engine policy package
|
||||||
|
|
||||||
```task
|
```task
|
||||||
id: FLEX-WP-0008-T02
|
id: FLEX-WP-0008-T02
|
||||||
status: todo
|
status: done
|
||||||
priority: high
|
priority: high
|
||||||
|
state_hub_task_id: "8a07e83b-27a2-4390-a169-51065bcf3bd6"
|
||||||
```
|
```
|
||||||
|
|
||||||
Policy: writes require an `aal2`+ assurance actor holding an appropriate
|
Policy: writes require an `aal2`+ assurance actor holding an appropriate
|
||||||
|
|
@ -87,12 +100,47 @@ Done when: `POST /v1/check` against a request matching `TEN-WP-0003`'s
|
||||||
and `deny` for an unauthorized one, exercised by `main_test.go`-style
|
and `deny` for an unauthorized one, exercised by `main_test.go`-style
|
||||||
integration tests.
|
integration tests.
|
||||||
|
|
||||||
|
**Done 2026-07-23, with the design decision made explicit:** chose
|
||||||
|
**operator/service-identity authorization**, not `aal2`+assurance +
|
||||||
|
tenant-capability-role checking, for this specific policy. Reasoning,
|
||||||
|
recorded here rather than left implicit: `tenant_engine`'s `CheckRequest`
|
||||||
|
today carries no `assurance` claim at all (there's no authenticated caller
|
||||||
|
identity yet — `TEN-WP-0003`'s closure note already flagged `actor` as a
|
||||||
|
plain request-body field, not a real auth context), and a tenant's
|
||||||
|
capability roles (`PLTF`/`IAM`/`VEN`/`CUS`) are a property of the *tenant*
|
||||||
|
being written to, not of *who is allowed to call tenant-engine's admin API*
|
||||||
|
— checking the wrong one would be a category error, the same one flagged
|
||||||
|
in `docs/tenant-engine-action-vocabulary.md`. So: `examples/tenant-engine/policy_package.md`
|
||||||
|
authorizes exactly one registered service subject (`tenant-engine` itself,
|
||||||
|
`subject_manifest.yaml`) for the four known actions against
|
||||||
|
`system: "tenant-engine"`. Revisit once `KEY-WP-0005` gives callers a real
|
||||||
|
`assurance`-bearing identity to check.
|
||||||
|
|
||||||
|
Registered: `protected_system_manifest.yaml`, `subject_manifest.yaml`,
|
||||||
|
`policy_package.md` (Rego rules + embedded tests), `policy_fixtures.yaml`
|
||||||
|
(8 allow/deny pairs), assembled `registry_snapshot.json`, two standalone
|
||||||
|
`check_request_*.json` examples, `README.md`.
|
||||||
|
|
||||||
|
**Verified for real, not just written:** built the actual `flex-auth`
|
||||||
|
binary (`go build ./cmd/flex-auth`) and ran it against every artifact:
|
||||||
|
`test-policy` — all 6 Rego tests and all 8 fixtures pass; `load-registry`
|
||||||
|
loads the snapshot cleanly; `check` against both standalone request files
|
||||||
|
returns the expected `allow`/`deny`. Then went one step further than the
|
||||||
|
task's own done-criteria: ran a **live `flex-auth serve`** with this exact
|
||||||
|
registry+policy and pointed `tenant-engine`'s real, unmodified
|
||||||
|
`FlexAuthCheckClient`/`FlexAuthWriteAuthorizer` at it (`TENANT_ENGINE_FLEX_AUTH_URL`)
|
||||||
|
— `POST /tenants` with `actor="ops"` → `403 unknown_subject`; with
|
||||||
|
`actor="tenant-engine"` → `201`. Full round trip, both processes, real
|
||||||
|
HTTP, real Rego evaluation. `go test ./...` still green across the whole
|
||||||
|
`flex-auth` repo — nothing broken.
|
||||||
|
|
||||||
## Task: tenant-engine live-lookup context adapter
|
## Task: tenant-engine live-lookup context adapter
|
||||||
|
|
||||||
```task
|
```task
|
||||||
id: FLEX-WP-0008-T03
|
id: FLEX-WP-0008-T03
|
||||||
status: todo
|
status: todo
|
||||||
priority: medium
|
priority: medium
|
||||||
|
state_hub_task_id: "20c005a4-48b7-4ac4-a345-aeaa0de06d80"
|
||||||
```
|
```
|
||||||
|
|
||||||
A context-enrichment adapter (mirrors `internal/adapters/{relationship,rule,topaz}`'s
|
A context-enrichment adapter (mirrors `internal/adapters/{relationship,rule,topaz}`'s
|
||||||
|
|
@ -115,6 +163,7 @@ with an empty result.
|
||||||
id: FLEX-WP-0008-T04
|
id: FLEX-WP-0008-T04
|
||||||
status: todo
|
status: todo
|
||||||
priority: low
|
priority: low
|
||||||
|
state_hub_task_id: "0c59ada6-c61b-41a3-8baa-a98e936c5690"
|
||||||
```
|
```
|
||||||
|
|
||||||
Confirm T01–T03 done; run flex-auth's existing test suite plus the new
|
Confirm T01–T03 done; run flex-auth's existing test suite plus the new
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue