id: qonto-assistant
name: Qonto Governed Assistant
resource_types:
  - name: finance-snapshot
    scope_level: Resource
    planes:
      - Data
      - Audit
    metadata:
      description: >-
        Read-only Qonto finance capability surface (org summary,
        transactions, CostRunRate hints). No spend/transfer/card/write
        capability is ever registered here -- those are hard-denied inside
        qonto-assistant's own policy kernel and never reach flex-auth.
actions:
  - name: finance.qonto.read
    capabilities:
      - View
      - Audit
    planes:
      - Data
      - Audit
    exposure_modes:
      - Masked
    metadata:
      required_context: []
      description: >-
        Coarse "may this actor use qonto-assistant's read surface at all"
        gate. Tenant capability-role/plan liveness (VEN/CUS, ADR-0014) is a
        separate check against tenant-engine's live-lookup endpoint, not
        encoded in this policy -- conflating the two would authorize the
        wrong thing (see tenant-engine's own policy_package.md note).
caring_profiles:
  - caring-0.4.0-rc2
metadata:
  flex_auth_contract: protected-system-v0
  boundary_contract: qonto-assistant/docs/SecurityPractice.md