Authorize tenant-engine guardrail read and set actions
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.
This commit is contained in:
parent
8563c17a9f
commit
f304688d72
13 changed files with 627 additions and 34 deletions
|
|
@ -8,12 +8,12 @@ protected-system consumer, gating its own write API
|
|||
|
||||
| File | Purpose |
|
||||
| --- | --- |
|
||||
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`) and the seven actions: `tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, `tenant.plan.assign`, plus the `FLEX-WP-0010` lifecycle actions `tenant.update`, `tenant.retire`, `tenant.reactivate` |
|
||||
| `subject_manifest.yaml` | The one registered caller: `tenant-engine`'s own service identity |
|
||||
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`, `guardrail`) and the nine actions: the original four, the `FLEX-WP-0010` lifecycle trio, and the `FLEX-WP-0014` guardrail pair `tenant.guardrail.read` / `tenant.guardrail.set` |
|
||||
| `subject_manifest.yaml` | Two registered callers: `tenant-engine` (all nine actions) and `flex-auth` (read-only on `tenant.guardrail.read`) |
|
||||
| `policy_package.md` | Rego rules + embedded tests gating the write API |
|
||||
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
|
||||
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
|
||||
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json` | Standalone example requests for `flex-auth check` |
|
||||
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json` | Standalone example requests for `flex-auth check` |
|
||||
|
||||
**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
|
||||
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
|
||||
|
|
@ -88,8 +88,33 @@ driven through the client, which only ever emits the seven registered strings
|
|||
| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` |
|
||||
| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` |
|
||||
|
||||
Rollback target is `sha256:c25fc34a…` (four-action). TEN-WP-0006 guardrail
|
||||
actions are **not** in this image.
|
||||
Rollback target is `sha256:c25fc34a…` (four-action).
|
||||
|
||||
## Verified — guardrail actions (FLEX-WP-0014-T03, 2026-08-16)
|
||||
|
||||
`test-policy` reports **17/17 Rego tests and 23/23 fixtures passing**, the
|
||||
registry loads (2 subjects, 2 groups), and `go test ./...` / `gofmt` /
|
||||
`go vet` are clean.
|
||||
|
||||
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
|
||||
loaded with this registry and policy, and a real `tenant-engine`
|
||||
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
|
||||
unmodified `FlexAuthWriteAuthorizer`:
|
||||
|
||||
| Call | tenant-engine | flex-auth decision |
|
||||
| --- | --- | --- |
|
||||
| `POST /tenants` actor=`tenant-engine` | 201 | allow `write_api_policy_matched` |
|
||||
| `GET .../guardrails?actor=flex-auth` | 200 grouping `spend.monthly=25000` | allow |
|
||||
| `GET .../guardrails?actor=ops` | 403 `write_denied` | deny `unknown_subject` |
|
||||
| `PUT .../guardrails/spend.monthly` actor=`tenant-engine` | 200 override `9000` v2 | allow |
|
||||
| `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` |
|
||||
| `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` |
|
||||
|
||||
**In source, not yet in the production image.** The live
|
||||
`flex-auth-tenant-engine` Deployment still serves the seven-action
|
||||
`sha256:9320df39` pin. A CI-built image from this commit plus a pin
|
||||
restore is the remaining step before a live guardrail check succeeds
|
||||
against the cluster Service.
|
||||
|
||||
## Related
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"id": "check:tenant-engine-guardrail-read-pdp",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {
|
||||
"id": "flex-auth",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {
|
||||
"id": "t-1",
|
||||
"type": "guardrail",
|
||||
"system": "tenant-engine"
|
||||
},
|
||||
"context": {}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"id": "check:tenant-engine-guardrail-set-writer",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {
|
||||
"id": "tenant-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {
|
||||
"id": "t-1",
|
||||
"type": "guardrail",
|
||||
"system": "tenant-engine"
|
||||
},
|
||||
"context": {}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"id": "check:tenant-engine-guardrail-set-pdp",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {
|
||||
"id": "flex-auth",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {
|
||||
"id": "t-1",
|
||||
"type": "guardrail",
|
||||
"system": "tenant-engine"
|
||||
},
|
||||
"context": {}
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"id": "check:tenant-engine-guardrail-get",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {
|
||||
"id": "flex-auth",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "tenant.guardrail.get",
|
||||
"resource": {
|
||||
"id": "t-1",
|
||||
"type": "guardrail",
|
||||
"system": "tenant-engine"
|
||||
},
|
||||
"context": {}
|
||||
}
|
||||
|
|
@ -190,5 +190,89 @@
|
|||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "deny", "reason": "wrong_subject_type"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-read-pdp-allow",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-read-pdp",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-read-writer-allow",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-read-writer",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "tenant-engine", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-set-writer-allow",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-set-writer",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "tenant-engine", "type": "service"},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "allow", "reason": "write_api_policy_matched"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-set-pdp-deny",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-set-pdp",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "deny", "reason": "action_not_granted"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-read-ops",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "ops", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-set-ops",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "ops", "type": "service"},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "deny", "reason": "unknown_subject"}
|
||||
},
|
||||
{
|
||||
"id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
|
||||
"request": {
|
||||
"id": "check:tenant-engine-guardrail-get",
|
||||
"tenant": "tenant:friendly:binky",
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.get",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
|
||||
"context": {}
|
||||
},
|
||||
"expect": {"effect": "deny", "reason": "unknown_action"}
|
||||
}
|
||||
]
|
||||
|
|
|
|||
|
|
@ -13,6 +13,8 @@ actions:
|
|||
- tenant.update
|
||||
- tenant.retire
|
||||
- tenant.reactivate
|
||||
- tenant.guardrail.read
|
||||
- tenant.guardrail.set
|
||||
owner: team:platform-security
|
||||
fixtures:
|
||||
- policy_fixtures.yaml
|
||||
|
|
@ -39,6 +41,7 @@ caring:
|
|||
- EditAny
|
||||
- Archive
|
||||
- Restore
|
||||
- View
|
||||
- Audit
|
||||
exposure_modes:
|
||||
- Metadata
|
||||
|
|
@ -114,6 +117,46 @@ options are an assurance floor on `tenant.retire` or a distinct
|
|||
`group:tenant-engine-lifecycle` membership requirement; both are one rule in
|
||||
`allowed` plus a `first_denial` branch.
|
||||
|
||||
## Guardrail actions (FLEX-WP-0014)
|
||||
|
||||
`tenant.guardrail.read` and `tenant.guardrail.set` gate tenant-engine's
|
||||
ceiling surface (`GET /tenants/{id}/guardrails`,
|
||||
`PUT`/`DELETE /tenants/{id}/guardrails/{limit_key}`). The strings are the
|
||||
exact values `authz.FlexAuthWriteAuthorizer` sends. Resource type is
|
||||
`guardrail`; `resource.id` is still the tenant id.
|
||||
|
||||
They are two actions because a PDP must be able to read ceilings without
|
||||
being able to change them. tenant-engine is a data source, never a decision
|
||||
maker; flex-auth is the intended reader.
|
||||
|
||||
### Decision: use the read/write split now
|
||||
|
||||
**Decision (FLEX-WP-0014-T02, 2026-08-16): yes.** `flex-auth` may
|
||||
`tenant.guardrail.read` and may not `tenant.guardrail.set`.
|
||||
`tenant-engine` may do both. Nobody else may do either.
|
||||
|
||||
Reasoning:
|
||||
|
||||
1. **The second subject exists and is named.** TEN-WP-0006 split the
|
||||
actions so "policy can grant you [flex-auth] the read without granting
|
||||
anything the write." Their own HTTP tests call the read as
|
||||
`actor=flex-auth`. Leaving both actions on the single `tenant-engine`
|
||||
subject would keep the seam unused and leave the intended reader
|
||||
failing `unknown_subject`.
|
||||
2. **This is a real difference, not a named no-op.** Unlike
|
||||
FLEX-WP-0010-T02, there is a second service identity to distinguish
|
||||
from, and a check the reader can fail (`tenant.guardrail.set` as
|
||||
`flex-auth` → `action_not_granted`).
|
||||
3. **Do not invent an `ops` write subject.** Production writes already
|
||||
authorize only the `tenant-engine` service identity. Guardrail
|
||||
mutations stay on that same identity. Adding `ops` would widen the
|
||||
write set without a registered operator.
|
||||
4. **Do not grant flex-auth any mutate action.** A PDP that can raise a
|
||||
ceiling is no longer only a decision maker.
|
||||
|
||||
**Revisit when** a second human/operator subject is registered, or when
|
||||
flex-auth itself needs to read as a different subject id than `flex-auth`.
|
||||
|
||||
## Rules
|
||||
|
||||
```rego
|
||||
|
|
@ -129,9 +172,19 @@ valid_actions := {
|
|||
"tenant.update",
|
||||
"tenant.retire",
|
||||
"tenant.reactivate",
|
||||
"tenant.guardrail.read",
|
||||
"tenant.guardrail.set",
|
||||
}
|
||||
|
||||
known_operators := {"tenant-engine"}
|
||||
read_actions := {"tenant.guardrail.read"}
|
||||
|
||||
mutate_actions := valid_actions - read_actions
|
||||
|
||||
known_subjects := {"tenant-engine", "flex-auth"}
|
||||
|
||||
read_subjects := {"tenant-engine", "flex-auth"}
|
||||
|
||||
mutate_subjects := {"tenant-engine"}
|
||||
|
||||
decision := {"effect": "allow", "reason": "write_api_policy_matched"} if {
|
||||
allowed
|
||||
|
|
@ -141,9 +194,16 @@ decision := {"effect": "allow", "reason": "write_api_policy_matched"} if {
|
|||
|
||||
allowed if {
|
||||
input.resource.system == "tenant-engine"
|
||||
input.action in valid_actions
|
||||
input.action in read_actions
|
||||
input.subject.type == "service"
|
||||
input.subject.id in known_operators
|
||||
input.subject.id in read_subjects
|
||||
}
|
||||
|
||||
allowed if {
|
||||
input.resource.system == "tenant-engine"
|
||||
input.action in mutate_actions
|
||||
input.subject.type == "service"
|
||||
input.subject.id in mutate_subjects
|
||||
}
|
||||
|
||||
default first_denial := "no_matching_rule"
|
||||
|
|
@ -155,7 +215,9 @@ first_denial := "wrong_system" if {
|
|||
} else := "wrong_subject_type" if {
|
||||
input.subject.type != "service"
|
||||
} else := "unknown_subject" if {
|
||||
not input.subject.id in known_operators
|
||||
not input.subject.id in known_subjects
|
||||
} else := "action_not_granted" if {
|
||||
input.subject.id in known_subjects
|
||||
}
|
||||
```
|
||||
|
||||
|
|
@ -258,4 +320,52 @@ test_wrong_subject_type_denied if {
|
|||
"resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_guardrail_read_by_pdp_allowed if {
|
||||
write_api.decision.effect == "allow" with input as {
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_guardrail_read_by_writer_allowed if {
|
||||
write_api.decision.effect == "allow" with input as {
|
||||
"subject": {"id": "tenant-engine", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_guardrail_set_by_writer_allowed if {
|
||||
write_api.decision.effect == "allow" with input as {
|
||||
"subject": {"id": "tenant-engine", "type": "service"},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_guardrail_set_by_pdp_denied if {
|
||||
write_api.decision.reason == "action_not_granted" with input as {
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.set",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_guardrail_read_unknown_subject_denied if {
|
||||
write_api.decision.reason == "unknown_subject" with input as {
|
||||
"subject": {"id": "ops", "type": "service"},
|
||||
"action": "tenant.guardrail.read",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
|
||||
test_misspelled_guardrail_action_denied if {
|
||||
write_api.decision.reason == "unknown_action" with input as {
|
||||
"subject": {"id": "flex-auth", "type": "service"},
|
||||
"action": "tenant.guardrail.get",
|
||||
"resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
|
|
|||
|
|
@ -23,6 +23,15 @@ resource_types:
|
|||
- Audit
|
||||
metadata:
|
||||
description: A tenant's plan/subscription assignment (by reference id).
|
||||
- name: guardrail
|
||||
scope_level: Resource
|
||||
planes:
|
||||
- Policy
|
||||
- Audit
|
||||
metadata:
|
||||
description: >-
|
||||
A tenant's resolved ceiling (spend, seats, and similar limits) plus
|
||||
the provenance of that value. Not an entitlement and not a meter.
|
||||
actions:
|
||||
- name: tenant.create
|
||||
capabilities:
|
||||
|
|
@ -105,6 +114,28 @@ actions:
|
|||
- Metadata
|
||||
metadata:
|
||||
required_context: []
|
||||
- name: tenant.guardrail.read
|
||||
capabilities:
|
||||
- View
|
||||
- Audit
|
||||
planes:
|
||||
- Policy
|
||||
- Audit
|
||||
exposure_modes:
|
||||
- Metadata
|
||||
metadata:
|
||||
required_context: []
|
||||
- name: tenant.guardrail.set
|
||||
capabilities:
|
||||
- EditAny
|
||||
- Audit
|
||||
planes:
|
||||
- Policy
|
||||
- Audit
|
||||
exposure_modes:
|
||||
- Metadata
|
||||
metadata:
|
||||
required_context: []
|
||||
caring_profiles:
|
||||
- caring-0.4.0-rc2
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -37,6 +37,17 @@
|
|||
"metadata": {
|
||||
"description": "A tenant's plan/subscription assignment (by reference id)."
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "guardrail",
|
||||
"scope_level": "Resource",
|
||||
"planes": [
|
||||
"Policy",
|
||||
"Audit"
|
||||
],
|
||||
"metadata": {
|
||||
"description": "A tenant's resolved ceiling (spend, seats, and similar limits) plus the provenance of that value. Not an entitlement and not a meter."
|
||||
}
|
||||
}
|
||||
],
|
||||
"actions": [
|
||||
|
|
@ -162,6 +173,40 @@
|
|||
"metadata": {
|
||||
"required_context": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tenant.guardrail.read",
|
||||
"capabilities": [
|
||||
"View",
|
||||
"Audit"
|
||||
],
|
||||
"planes": [
|
||||
"Policy",
|
||||
"Audit"
|
||||
],
|
||||
"exposure_modes": [
|
||||
"Metadata"
|
||||
],
|
||||
"metadata": {
|
||||
"required_context": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "tenant.guardrail.set",
|
||||
"capabilities": [
|
||||
"EditAny",
|
||||
"Audit"
|
||||
],
|
||||
"planes": [
|
||||
"Policy",
|
||||
"Audit"
|
||||
],
|
||||
"exposure_modes": [
|
||||
"Metadata"
|
||||
],
|
||||
"metadata": {
|
||||
"required_context": []
|
||||
}
|
||||
}
|
||||
],
|
||||
"caring_profiles": [
|
||||
|
|
@ -190,11 +235,28 @@
|
|||
"Operator"
|
||||
],
|
||||
"groups": [
|
||||
"group:tenant-engine-writers"
|
||||
"group:tenant-engine-writers",
|
||||
"group:tenant-engine-readers"
|
||||
],
|
||||
"tenant": "tenant:platform",
|
||||
"metadata": {
|
||||
"description": "tenant-engine's own service identity, used for the seven write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, and the lifecycle actions tenant.update, tenant.retire, tenant.reactivate."
|
||||
"description": "tenant-engine's own service identity, used for the nine write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, the lifecycle actions tenant.update, tenant.retire, tenant.reactivate, and the guardrail actions tenant.guardrail.read, tenant.guardrail.set."
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "flex-auth",
|
||||
"type": "Service",
|
||||
"display_name": "flex-auth service principal",
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
],
|
||||
"groups": [
|
||||
"group:tenant-engine-readers"
|
||||
],
|
||||
"tenant": "tenant:platform",
|
||||
"metadata": {
|
||||
"description": "flex-auth's own service identity. Authorized only for tenant.guardrail.read so the PDP can consume ceilings without being able to change them (FLEX-WP-0014)."
|
||||
}
|
||||
}
|
||||
],
|
||||
|
|
@ -206,6 +268,15 @@
|
|||
"tenant-engine"
|
||||
],
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
{
|
||||
"id": "group:tenant-engine-readers",
|
||||
"display_name": "tenant-engine Guardrail Readers",
|
||||
"members": [
|
||||
"flex-auth",
|
||||
"tenant-engine"
|
||||
],
|
||||
"tenant": "tenant:platform"
|
||||
}
|
||||
],
|
||||
"relationships": []
|
||||
|
|
|
|||
|
|
@ -11,17 +11,39 @@ subjects:
|
|||
- Operator
|
||||
groups:
|
||||
- group:tenant-engine-writers
|
||||
- group:tenant-engine-readers
|
||||
tenant: tenant:platform
|
||||
metadata:
|
||||
description: >-
|
||||
tenant-engine's own service identity, used for the seven write-API
|
||||
tenant-engine's own service identity, used for the nine write-API
|
||||
actions it sends to POST /v1/check
|
||||
(authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
|
||||
tenant.role.revoke, tenant.plan.assign, and the lifecycle actions
|
||||
tenant.update, tenant.retire, tenant.reactivate.
|
||||
tenant.role.revoke, tenant.plan.assign, the lifecycle actions
|
||||
tenant.update, tenant.retire, tenant.reactivate, and the
|
||||
guardrail actions tenant.guardrail.read, tenant.guardrail.set.
|
||||
- id: flex-auth
|
||||
type: Service
|
||||
display_name: flex-auth service principal
|
||||
organization_relation: ServiceProvider
|
||||
roles:
|
||||
- Operator
|
||||
groups:
|
||||
- group:tenant-engine-readers
|
||||
tenant: tenant:platform
|
||||
metadata:
|
||||
description: >-
|
||||
flex-auth's own service identity. Authorized only for
|
||||
tenant.guardrail.read so the PDP can consume ceilings without
|
||||
being able to change them (FLEX-WP-0014).
|
||||
groups:
|
||||
- id: group:tenant-engine-writers
|
||||
display_name: tenant-engine Write API Callers
|
||||
members:
|
||||
- tenant-engine
|
||||
tenant: tenant:platform
|
||||
- id: group:tenant-engine-readers
|
||||
display_name: tenant-engine Guardrail Readers
|
||||
members:
|
||||
- flex-auth
|
||||
- tenant-engine
|
||||
tenant: tenant:platform
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue