id: subjects:secrets-engine-operators
tenants:
  - id: tenant:platform
    name: Platform Tenant
subjects:
  - id: secrets-engine
    type: Service
    display_name: secrets-engine service principal
    organization_relation: ServiceProvider
    roles:
      - Operator
    groups:
      - group:secrets-engine-lane-operators
    tenant: tenant:platform
    metadata:
      description: >-
        secrets-engine's own service identity, the single calling identity for
        the twelve gated catalog-lane actions it sends to POST /v1/check.
        Because it is the only subject, the package has no action_not_granted
        branch (FLEX-WP-0021-T02); registering a second identity is the
        revisit trigger.
groups:
  - id: group:secrets-engine-lane-operators
    display_name: secrets-engine Catalog Lane Operators
    members:
      - secrets-engine
    tenant: tenant:platform