tegwick
8e127e50f7
Extend the tenant-engine write-API policy package with tenant.update, tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005 introduced. Until now every lifecycle mutation resolved to deny unknown_action, blocking TEN-WP-0005-T05 production rollout. - policy_package.md: three actions in valid_actions and frontmatter; CARING capabilities extended with EditAny/Archive/Restore - protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt registry_snapshot.json carry all seven actions - docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces - 8 new fixture pairs and 5 new Rego tests, including action-drift guards (tenant.retired, tenant_update -> unknown_action) T02 decision, recorded in policy_package.md: tenant.retire does NOT get stricter authorization yet. With one service subject and no assurance claim in the CheckRequest there is nothing stricter to check, and a condition the sole caller always satisfies would falsely read as separate control. Retirement is reversible and non-destructive. Revisit on KEY-WP-0005 assurance claims or a second operator subject. Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt and go vet clean. End-to-end against a live serve with a real tenant-engine through the unmodified FlexAuthWriteAuthorizer: update 6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970 all allow; unregistered actor denied unknown_subject (59d3e99c6416be89, 403 write_denied). Handoff revision for TEN-WP-0005-T05: package tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
212 lines
4.8 KiB
JSON
212 lines
4.8 KiB
JSON
{
|
|
"systems": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"name": "Tenant Engine",
|
|
"resource_types": [
|
|
{
|
|
"name": "tenant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant record (existence, onboarding grouping)."
|
|
}
|
|
},
|
|
{
|
|
"name": "role-grant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
|
|
}
|
|
},
|
|
{
|
|
"name": "plan-assignment",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant's plan/subscription assignment (by reference id)."
|
|
}
|
|
}
|
|
],
|
|
"actions": [
|
|
{
|
|
"name": "tenant.create",
|
|
"capabilities": [
|
|
"Create",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.grant",
|
|
"capabilities": [
|
|
"Grant",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.revoke",
|
|
"capabilities": [
|
|
"Revoke",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.plan.assign",
|
|
"capabilities": [
|
|
"Bind",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.update",
|
|
"capabilities": [
|
|
"EditAny",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.retire",
|
|
"capabilities": [
|
|
"Archive",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.reactivate",
|
|
"capabilities": [
|
|
"Restore",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
}
|
|
],
|
|
"caring_profiles": [
|
|
"caring-0.4.0-rc2"
|
|
],
|
|
"metadata": {
|
|
"flex_auth_contract": "protected-system-v0",
|
|
"boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
|
|
}
|
|
}
|
|
],
|
|
"resource_manifests": [],
|
|
"tenants": [
|
|
{
|
|
"id": "tenant:platform",
|
|
"name": "Platform Tenant"
|
|
}
|
|
],
|
|
"subjects": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"type": "Service",
|
|
"display_name": "tenant-engine service principal",
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
],
|
|
"groups": [
|
|
"group:tenant-engine-writers"
|
|
],
|
|
"tenant": "tenant:platform",
|
|
"metadata": {
|
|
"description": "tenant-engine's own service identity, used for the seven write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, and the lifecycle actions tenant.update, tenant.retire, tenant.reactivate."
|
|
}
|
|
}
|
|
],
|
|
"groups": [
|
|
{
|
|
"id": "group:tenant-engine-writers",
|
|
"display_name": "tenant-engine Write API Callers",
|
|
"members": [
|
|
"tenant-engine"
|
|
],
|
|
"tenant": "tenant:platform"
|
|
}
|
|
],
|
|
"relationships": []
|
|
}
|