{
  "systems": [
    {
      "id": "tenant-engine",
      "name": "Tenant Engine",
      "resource_types": [
        {
          "name": "tenant",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Audit"
          ],
          "metadata": {
            "description": "A tenant record (existence, onboarding grouping)."
          }
        },
        {
          "name": "role-grant",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "metadata": {
            "description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
          }
        },
        {
          "name": "plan-assignment",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Audit"
          ],
          "metadata": {
            "description": "A tenant's plan/subscription assignment (by reference id)."
          }
        }
      ],
      "actions": [
        {
          "name": "tenant.create",
          "capabilities": [
            "Create",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.role.grant",
          "capabilities": [
            "Grant",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.role.revoke",
          "capabilities": [
            "Revoke",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.plan.assign",
          "capabilities": [
            "Bind",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        }
      ],
      "caring_profiles": [
        "caring-0.4.0-rc2"
      ],
      "metadata": {
        "flex_auth_contract": "protected-system-v0",
        "boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
      }
    }
  ],
  "resource_manifests": [],
  "tenants": [
    {
      "id": "tenant:platform",
      "name": "Platform Tenant"
    }
  ],
  "subjects": [
    {
      "id": "tenant-engine",
      "type": "Service",
      "display_name": "tenant-engine service principal",
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:tenant-engine-writers"
      ],
      "tenant": "tenant:platform",
      "metadata": {
        "description": "tenant-engine's own service identity, used for the tenant.create / tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer)."
      }
    }
  ],
  "groups": [
    {
      "id": "group:tenant-engine-writers",
      "display_name": "tenant-engine Write API Callers",
      "members": [
        "tenant-engine"
      ],
      "tenant": "tenant:platform"
    }
  ],
  "relationships": []
}