coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): add credential grant authorization package
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:59:03 +02:00
parent df54c1b8f5
commit acbaa4a7c9
12 changed files with 476 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/railiance-platform-action-vocabulary.md Normal file
View file

@ -0,0 +1,16 @@
# Railiance Platform credential-grant action vocabulary
flex-auth uses one protected-system action for the credential broker:
| Action | Resource type | Meaning |
| --- | --- | --- |
| `issue` | `credential-grant` | Authorize issuance of one bounded credential lease from a registered grant. |
The request subject is the requesting actor. `context.bound_subject` is the
identity to which the resulting credential is bound. Grant id, credential
type, issuer, audience, TTL ceiling, permitted actor classes, purposes, and
delivery modes are registry-owned resource attributes, not caller assertions.
`context.requested_ttl_seconds` is numeric seconds. Parsing the broker's source
duration string happens once in the selected wire translator; the policy
rejects strings to prevent unit ambiguity.