coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): adopt security zone stances
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:17:13 +02:00
parent fbef547cfa
commit e521e7b715
8 changed files with 248 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

77
examples/ops-warden/policy_fixtures.yaml
View file

@ -24,7 +24,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -67,7 +69,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -108,7 +112,9 @@
"allowed_principals": [
"backup"
],
"max_ttl_hours": 1
"max_ttl_hours": 1,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -150,7 +156,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -192,7 +200,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -234,7 +244,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -276,7 +288,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -318,7 +332,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -333,5 +349,50 @@
"effect": "deny",
"reason": "missing_pubkey_fingerprint"
}
},
{
"id": "fixture:ops-warden-unknown-zone-advisory",
"request": {
"id": "check:ops-warden-unknown-zone",
"tenant": "tenant:platform",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden",
"attributes": {
"actor_id": "platform-steward",
"actor_type": "adm",
"allowed_subjects": [
"platform-steward",
"iam:platform-steward"
],
"allowed_principals": [
"platform",
"root"
],
"max_ttl_hours": 8,
"security_zone": "unknown",
"security_zone_admission": "unknown"
}
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
},
"expect": {
"effect": "audit_only",
"reason": "advisory_would_signing_policy_matched"
}
}
]