id: subjects:tenant-engine-operators
tenants:
  - id: tenant:platform
    name: Platform Tenant
subjects:
  - id: tenant-engine
    type: Service
    display_name: tenant-engine service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:tenant-engine-writers
    tenant: tenant:platform
    metadata:
      description: >-
        tenant-engine's own service identity, used for the seven write-API
        actions it sends to POST /v1/check
        (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
        tenant.role.revoke, tenant.plan.assign, and the lifecycle actions
        tenant.update, tenant.retire, tenant.reactivate.
groups:
  - id: group:tenant-engine-writers
    display_name: tenant-engine Write API Callers
    members:
      - tenant-engine
    tenant: tenant:platform