# user-engine policy service

Dynamic human subjects arrive as verified KeyCape claims, so the registry
defines the protected system while the policy evaluates tenant, roles, and
self context from each request. Platform operators may cross tenants;
tenant administrators and self-service users may not.

Validate with:

```bash
flex-auth test-policy -file examples/user-engine/policy_package.md
flex-auth load-registry -file examples/user-engine/registry_snapshot.json
```

## Live production (FLEX-WP-0009-T04, 2026-08-16)

Service: `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`
Image: `forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`

`test-policy` reports 9/9 Rego tests and 9/9 fixtures. The same nine
fixtures were replayed against the deployed `/v1/check` and all matched:

| Fixture | Effect / reason | Decision id |
| --- | --- | --- |
| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` |
| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` |
| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` |
| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` |
| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` |
| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` |
| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` |
| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` |
| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` |

From the user-engine namespace the Service `/healthz` is HTTP 200.
Unavailability is connection-refused / NXDOMAIN; the consumer adapter
denies with `authorization service unavailable`.