id: subjects:tenant-engine-operators
tenants:
  - id: tenant:platform
    name: Platform Tenant
subjects:
  - id: tenant-engine
    type: Service
    display_name: tenant-engine service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:tenant-engine-writers
    tenant: tenant:platform
    metadata:
      description: >-
        tenant-engine's own service identity, used for the tenant.create /
        tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions
        it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer).
groups:
  - id: group:tenant-engine-writers
    display_name: tenant-engine Write API Callers
    members:
      - tenant-engine
    tenant: tenant:platform