{
  "systems": [
    {
      "id": "secrets-engine",
      "name": "Secrets Engine",
      "resource_types": [
        {
          "name": "secret-catalog-lane",
          "scope_level": "Resource",
          "planes": [
            "Secret",
            "Policy",
            "Audit"
          ],
          "metadata": {
            "description": "A secret catalog lane: one catalog entry's delivery path at a given stage. The catalog id is resource.id; stage plus sorted fields, policy_targets, and auth_targets are resource.attributes. flex-auth never sees secret material, only the lane's coordinates."
          }
        }
      ],
      "actions": [
        {
          "name": "apply",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": [],
            "note": "apply --dry-run never reaches the gate, but the distinction is invisible here; both would arrive as \"apply\"."
          }
        },
        {
          "name": "provision",
          "capabilities": [
            "Create",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "rotate",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "verify",
          "capabilities": [
            "View",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "handoff",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "wrap",
          "capabilities": [
            "Execute",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "exec",
          "capabilities": [
            "Execute",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Execution",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "deactivate",
          "capabilities": [
            "Archive",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": [],
            "note": "Reached from both the CLI verb \"revoke\" and \"lifecycle deactivate\". There is no \"revoke\" action value."
          }
        },
        {
          "name": "suspend",
          "capabilities": [
            "Archive",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "destroy",
          "capabilities": [
            "DeleteAny",
            "Audit"
          ],
          "planes": [
            "Secret",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": [
              "approval"
            ],
            "note": "Dual control. Defined but not reachable live: the handler raises before the gate, so only --dry-run renders until SECRETS-WP-0007-T04."
          }
        },
        {
          "name": "compromise",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": [],
            "note": "Mutates local delivery overlay state only; touches no OpenBao object."
          }
        },
        {
          "name": "reactivate",
          "capabilities": [
            "Restore",
            "Audit"
          ],
          "planes": [
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": [],
            "note": "Mutates local delivery overlay state only; touches no OpenBao object."
          }
        }
      ],
      "caring_profiles": [
        "caring-0.4.0-rc2"
      ],
      "metadata": {
        "flex_auth_contract": "protected-system-v0",
        "action_vocabulary_source": "secrets-engine docs/gated-actions.md (FLEX-WP-0021-T01)"
      }
    }
  ],
  "resource_manifests": [],
  "tenants": [
    {
      "id": "tenant:platform",
      "name": "Platform Tenant"
    }
  ],
  "subjects": [
    {
      "id": "secrets-engine",
      "type": "Service",
      "display_name": "secrets-engine service principal",
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:secrets-engine-lane-operators"
      ],
      "tenant": "tenant:platform",
      "metadata": {
        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger."
      }
    }
  ],
  "groups": [
    {
      "id": "group:secrets-engine-lane-operators",
      "display_name": "secrets-engine Catalog Lane Operators",
      "members": [
        "secrets-engine"
      ],
      "tenant": "tenant:platform"
    }
  ],
  "relationships": []
}