id: subjects:tenant-engine-operators
tenants:
  - id: tenant:platform
    name: Platform Tenant
subjects:
  - id: tenant-engine
    type: Service
    display_name: tenant-engine service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:tenant-engine-writers
      - group:tenant-engine-readers
    tenant: tenant:platform
    metadata:
      description: >-
        tenant-engine's own service identity, used for the nine write-API
        actions it sends to POST /v1/check
        (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
        tenant.role.revoke, tenant.plan.assign, the lifecycle actions
        tenant.update, tenant.retire, tenant.reactivate, and the
        guardrail actions tenant.guardrail.read, tenant.guardrail.set.
  - id: flex-auth
    type: Service
    display_name: flex-auth service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:tenant-engine-readers
    tenant: tenant:platform
    metadata:
      description: >-
        flex-auth's own service identity. Authorized only for
        tenant.guardrail.read so the PDP can consume ceilings without
        being able to change them (FLEX-WP-0014).
groups:
  - id: group:tenant-engine-writers
    display_name: tenant-engine Write API Callers
    members:
      - tenant-engine
    tenant: tenant:platform
  - id: group:tenant-engine-readers
    display_name: tenant-engine Guardrail Readers
    members:
      - flex-auth
      - tenant-engine
    tenant: tenant:platform