{
  "systems": [
    {
      "id": "railiance-platform",
      "name": "Railiance Platform Credential Broker",
      "resource_types": [
        {
          "name": "credential-grant",
          "scope_level": "Resource",
          "planes": ["Identity", "Secret", "Audit"]
        }
      ],
      "actions": [
        {
          "name": "issue",
          "capabilities": ["Use", "Operate", "Audit"],
          "planes": ["Identity", "Secret", "Audit"],
          "exposure_modes": ["Metadata"]
        }
      ],
      "caring_profiles": ["caring-0.4.0-rc2"],
      "metadata": {"tenant": "tenant:platform"}
    }
  ],
  "resource_manifests": [
    {
      "id": "railiance-platform-credential-grants",
      "system": "railiance-platform",
      "resources": [
        {"id": "credential-grant:rapp-postgres/audit-core-runtime", "type": "credential-grant", "owner": "team:platform-security", "attributes": {"grant_id": "rapp-postgres/audit-core-runtime", "credential_type": "openbao-database-credential", "issuer": "openbao", "audience": "audit-core", "max_ttl_seconds": 3600, "allowed_actor_types": ["human-operator", "approved-agent", "ci-runner"], "allowed_purposes": ["audit-core-runtime"], "allowed_delivery_modes": ["exec-env"]}},
        {"id": "credential-grant:rapp-postgres/audit-core-migration", "type": "credential-grant", "owner": "team:platform-security", "attributes": {"grant_id": "rapp-postgres/audit-core-migration", "credential_type": "openbao-database-credential", "issuer": "openbao", "audience": "audit-core", "max_ttl_seconds": 1800, "allowed_actor_types": ["human-operator", "approved-agent", "ci-runner"], "allowed_purposes": ["audit-core-migration"], "allowed_delivery_modes": ["exec-env"]}},
        {"id": "credential-grant:ops-warden/warden-sign", "type": "credential-grant", "owner": "team:platform-security", "attributes": {"grant_id": "ops-warden/warden-sign", "credential_type": "openbao-token", "issuer": "openbao", "audience": "ops-warden", "max_ttl_seconds": 3600, "allowed_actor_types": ["human-operator", "approved-agent", "ci-runner"], "allowed_purposes": ["flex-auth-openbao-smoke", "ops-warden-production-sign-smoke"], "allowed_delivery_modes": ["exec-env", "response-wrap", "local-token-file", "kubernetes-auth"]}}
      ],
      "actions": ["issue"],
      "caring_profile": "caring-0.4.0-rc2",
      "metadata": {"tenant": "tenant:platform"}
    }
  ],
  "tenants": [{"id": "tenant:platform", "name": "Platform Tenant"}],
  "subjects": [
    {"id": "operator:platform", "type": "Human", "roles": ["Operator"], "tenant": "tenant:platform"},
    {"id": "agent:codex/railiance-platform", "type": "Agent", "roles": ["Operator"], "tenant": "tenant:platform"},
    {"id": "ci:railiance-platform", "type": "Automation", "roles": ["Operator"], "tenant": "tenant:platform"}
  ]
}