flex-auth/examples/tenant-engine

tenant-engine Consumer Integration Fixtures

FLEX-WP-0008-T01/T02. Registers tenant-engine as a flex-auth protected-system consumer, gating its own write API (TEN-WP-0003's authz.FlexAuthWriteAuthorizer).

Files

File	Purpose
protected_system_manifest.yaml	Resource types (tenant, role-grant, plan-assignment, guardrail) and the nine actions: the original four, the FLEX-WP-0010 lifecycle trio, and the FLEX-WP-0014 guardrail pair tenant.guardrail.read / tenant.guardrail.set
subject_manifest.yaml	Two registered callers: tenant-engine (all nine actions) and flex-auth (read-only on tenant.guardrail.read)
policy_package.md	Rego rules + embedded tests gating the write API
policy_fixtures.yaml	Allow/deny request/decision pairs, referenced by policy_package.md's frontmatter
registry_snapshot.json	Merged systems/subjects/groups snapshot assembled from the two manifests above, loadable by flex-auth serve/check/load-registry
check_request_allow_create.json, check_request_deny_unknown_subject.json, check_request_allow_retire.json, check_request_deny_misspelled_lifecycle.json, check_request_allow_guardrail_read.json, check_request_allow_guardrail_set.json, check_request_deny_guardrail_set_as_reader.json, check_request_deny_misspelled_guardrail.json	Standalone example requests for flex-auth check

No resource_manifest.yaml — unlike ops-warden's fixed SSH-certificate inventory, tenant-engine's resources (tenants) are created dynamically. See docs/tenant-engine-resource-namespace.md for why that's a deliberate omission, not an oversight.

Verified

go build -o bin/flex-auth ./cmd/flex-auth

# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md

# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json

# Individual requests via the CLI:
bin/flex-auth check \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md \
  -request examples/tenant-engine/check_request_allow_create.json

# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run

Verified — lifecycle actions (FLEX-WP-0010-T03, 2026-08-10)

test-policy reports 11/11 Rego tests and 16/16 fixtures passing, the registry loads, and go test ./... / gofmt / go vet are clean.

End-to-end over real HTTP: a live flex-auth serve on 127.0.0.1:9098 loaded with this registry and policy, and a real tenant-engine (TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098) driven through its unmodified FlexAuthWriteAuthorizer with Idempotency-Key and an If-Match echoed from a prior GET:

Call	tenant-engine	flex-auth decision
POST /tenants	201	decision:174dc9ecb03ed9e5 allow write_api_policy_matched
PATCH /tenants/t-e2e-1	200 active	decision:6176c39c2f4d7b15 allow write_api_policy_matched
POST /tenants/t-e2e-1/retire	200 retired	decision:8a801b8ee8455080 allow write_api_policy_matched
POST /tenants/t-e2e-1/reactivate	200 active	decision:c64cf3713cecd970 allow write_api_policy_matched
POST .../retire as actor: ops	403 write_denied	decision:59d3e99c6416be89 deny unknown_subject

The misspelled-action guard (tenant.retired → deny unknown_action) is covered by fixture and by check -request check_request_deny_misspelled_lifecycle.json; it cannot be driven through the client, which only ever emits the seven registered strings — which is the property the guard exists to protect.

In production as of FLEX-WP-0013 (2026-08-16). The live flex-auth-tenant-engine Deployment on railiance01 runs sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7 (CI-built from e9911eb). Probed against the Service after restore:

Action	Effect	Decision
tenant.create	allow write_api_policy_matched	decision:2a94b9ee0dcb4050
tenant.update	allow write_api_policy_matched	decision:422fe875467610fb
tenant.retire	allow write_api_policy_matched	decision:799301d3443fd6a4
tenant.reactivate	allow write_api_policy_matched	decision:4160478ca5499457
tenant.retired (typo)	deny unknown_action	decision:30946c43cbe80bfc
unregistered subject	deny unknown_subject	decision:7b107e73cf16fab9

Rollback target is sha256:c25fc34a… (four-action).

Verified — guardrail actions (FLEX-WP-0014-T03, 2026-08-16)

test-policy reports 17/17 Rego tests and 23/23 fixtures passing, the registry loads (2 subjects, 2 groups), and go test ./... / gofmt / go vet are clean.

End-to-end over real HTTP: a live flex-auth serve on 127.0.0.1:9098 loaded with this registry and policy, and a real tenant-engine (TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098) driven through its unmodified FlexAuthWriteAuthorizer:

Call	tenant-engine	flex-auth decision
POST /tenants actor=tenant-engine	201	allow write_api_policy_matched
GET .../guardrails?actor=flex-auth	200 grouping spend.monthly=25000	allow
GET .../guardrails?actor=ops	403 write_denied	deny unknown_subject
PUT .../guardrails/spend.monthly actor=tenant-engine	200 override 9000 v2	allow
PUT ... actor=flex-auth	403 write_denied	deny action_not_granted
PUT ... actor=ops	403 write_denied	deny unknown_subject

In production as of 2026-08-16. The live flex-auth-tenant-engine Deployment on railiance01 runs sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc (CI-built from f304688, tag main-f304688). Probed against the Service after pin:

Request	Effect	Decision
tenant.create	allow write_api_policy_matched	decision:ef18e8bbd2dead6a
tenant.retire	allow write_api_policy_matched	decision:996663f6902d0762
tenant.guardrail.read as flex-auth	allow write_api_policy_matched	decision:9b9e540de13cf7cf
tenant.guardrail.set as tenant-engine	allow write_api_policy_matched	decision:20c82bc38501a343
tenant.guardrail.set as flex-auth	deny action_not_granted	decision:a057a7030df65208
misspelled guardrail	deny unknown_action	decision:18ae70a79c6d47c6

Rollback target is sha256:9320df39 (seven-action). flex-auth-user-engine was not moved.

Consumer pin (operator apply 2026-08-16, TEN-WP-0007 step 2): live tenant-engine is sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574 (main-955fe33). Previous live digest was sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207. Their documented rollback image is sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612 (TEN-WP-0005 lifecycle). /health is 0.1.0; OpenAPI lists 12 paths including /tenants/{tenant_id}/guardrails.

Recorded from their handoff, so a later result does not surprise us:

• Newest commit is not always the newest image. After 955fe33 three non-trigger commits landed and no build fired; they pinned the verified digest, not HEAD.
• A guardrail read is sourced from an override or a grouping default. The plan-derived precedence layer has no feed (adaptive-pricing exposes no plan-derived ceilings). A missing plan layer is not a flex-auth policy gap.
• Rolling their image back is safe one way only: the old image ignores the new tables, but an override written on the new image stops being enforced after rollback. Inert until something consults guardrails.

Related

• docs/tenant-engine-resource-namespace.md
• docs/tenant-engine-action-vocabulary.md
• tenant-engine/docs/flex-auth-integration.md — the client side of this integration
• net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md