{
  "systems": [
    {
      "id": "tenant-engine",
      "name": "Tenant Engine",
      "resource_types": [
        {
          "name": "tenant",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Audit"
          ],
          "metadata": {
            "description": "A tenant record (existence, onboarding grouping)."
          }
        },
        {
          "name": "role-grant",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "metadata": {
            "description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
          }
        },
        {
          "name": "plan-assignment",
          "scope_level": "Resource",
          "planes": [
            "Identity",
            "Audit"
          ],
          "metadata": {
            "description": "A tenant's plan/subscription assignment (by reference id)."
          }
        },
        {
          "name": "guardrail",
          "scope_level": "Resource",
          "planes": [
            "Policy",
            "Audit"
          ],
          "metadata": {
            "description": "A tenant's resolved ceiling (spend, seats, and similar limits) plus the provenance of that value. Not an entitlement and not a meter."
          }
        }
      ],
      "actions": [
        {
          "name": "tenant.create",
          "capabilities": [
            "Create",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.role.grant",
          "capabilities": [
            "Grant",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.role.revoke",
          "capabilities": [
            "Revoke",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.plan.assign",
          "capabilities": [
            "Bind",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.update",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.retire",
          "capabilities": [
            "Archive",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.reactivate",
          "capabilities": [
            "Restore",
            "Audit"
          ],
          "planes": [
            "Identity",
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.guardrail.read",
          "capabilities": [
            "View",
            "Audit"
          ],
          "planes": [
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        },
        {
          "name": "tenant.guardrail.set",
          "capabilities": [
            "EditAny",
            "Audit"
          ],
          "planes": [
            "Policy",
            "Audit"
          ],
          "exposure_modes": [
            "Metadata"
          ],
          "metadata": {
            "required_context": []
          }
        }
      ],
      "caring_profiles": [
        "caring-0.4.0-rc2"
      ],
      "metadata": {
        "flex_auth_contract": "protected-system-v0",
        "boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
      }
    }
  ],
  "resource_manifests": [],
  "tenants": [
    {
      "id": "tenant:platform",
      "name": "Platform Tenant"
    }
  ],
  "subjects": [
    {
      "id": "tenant-engine",
      "type": "Service",
      "display_name": "tenant-engine service principal",
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:tenant-engine-writers",
        "group:tenant-engine-readers"
      ],
      "tenant": "tenant:platform",
      "metadata": {
        "description": "tenant-engine's own service identity, used for the nine write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, the lifecycle actions tenant.update, tenant.retire, tenant.reactivate, and the guardrail actions tenant.guardrail.read, tenant.guardrail.set."
      }
    },
    {
      "id": "flex-auth",
      "type": "Service",
      "display_name": "flex-auth service principal",
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:tenant-engine-readers"
      ],
      "tenant": "tenant:platform",
      "metadata": {
        "description": "flex-auth's own service identity. Authorized only for tenant.guardrail.read so the PDP can consume ceilings without being able to change them (FLEX-WP-0014)."
      }
    }
  ],
  "groups": [
    {
      "id": "group:tenant-engine-writers",
      "display_name": "tenant-engine Write API Callers",
      "members": [
        "tenant-engine"
      ],
      "tenant": "tenant:platform"
    },
    {
      "id": "group:tenant-engine-readers",
      "display_name": "tenant-engine Guardrail Readers",
      "members": [
        "flex-auth",
        "tenant-engine"
      ],
      "tenant": "tenant:platform"
    }
  ],
  "relationships": []
}