coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(authz): bind decisions to exact actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:18:26 +02:00
parent 7323dd1a60
commit c473f1971d
28 changed files with 644 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

9
SCOPE.md
View file

@ -83,6 +83,15 @@ fixtures), and the delegated PDP/directory adapter shapes (`FLEX-WP-0004`,
Topaz/OpenFGA/OPA/Cedar/Keycloak/Entra tradeoffs documented with at least one
controlled adapter shape) all landed in May 2026.
Standalone decisions include a structured `binding` containing the normalized
subject, action, resource, context, and a full request digest. This makes the
execute-time decision contract inspectable without parsing reason or diagnostic
prose. Durable human approval lifecycle, supersession, and authenticated
multi-approver evidence remain State Hub responsibilities; the proposed
cross-system object is documented in
`schemas/action_authorization.schema.json` and is not yet a deployed State Hub
endpoint.
The **first shipped protected-system consumer is ops-warden**: its opt-in
pre-sign gate calls `POST /v1/check` for `resource.type: ssh-certificate`,
`action: sign` decisions (`examples/ops-warden/`, policy package, allow/deny