coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/tenant-engine/policy_fixtures.yaml
tegwick 3081067325
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m24s
Details
State tenant-engine's tenant relation in the write-api package, v3. 
tenant-engine named the relation in TEN-DEC-2026-002: `tenant` is the target
tenant record and always equals `resource.id`; the write API is cross-tenant
by design and `tenant.guardrail.read` does not differ. v2 carried no tenant
rule and a constant fixture tenant, so the deliberate scope and an omitted
rule were indistinguishable.

tenant-engine.write-api.mutate v3 (FLEX-DEC-2026-016):
- allowed requires tenant_is_target; a mismatch or absent tenant is denied
  tenant_not_target (object.get, so an absent key names the right cause).
- the cross-tenant scope is stated in the package and quantified by
  test_tenant_never_changes_effect over every action, three subjects and
  four tenants, with guards against passing by denying everything.
- fixtures rotate tenant across four tenants; five cross-tenant allows and
  two tenant_not_target denies added (42 fixtures, 33 tests, all pass).
- user-engine's tenant:platform exclusion is named as a fixed-record rule,
  not a subject/tenant relation, and tested separately.

Closes FLEX-WP-0022 (T01, T02 done). Also records TEN-IN-0004 and
SECRETS-IN-0002 on FLEX-WP-0020 and acknowledges the GH-DEC-2026-017
replies on FLEX-WP-0030-T04.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
2026-09-21 07:39:57 +02:00

925 lines
22 KiB
YAML
Raw Blame History

[
{
"id": "fixture:tenant-engine-create-allow",
"request": {
"id": "check:tenant-engine-create-t1",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:friendly:binky",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-role-grant-allow",
"request": {
"id": "check:tenant-engine-role-grant-t1",
"tenant": "tenant:acme:prod",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.role.grant",
"resource": {
"id": "tenant:acme:prod",
"type": "role-grant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-role-revoke-allow",
"request": {
"id": "check:tenant-engine-role-revoke-t1",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.role.revoke",
"resource": {
"id": "tenant:platform",
"type": "role-grant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-plan-assign-allow",
"request": {
"id": "check:tenant-engine-plan-assign-t1",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.plan.assign",
"resource": {
"id": "tenant:trial:demo-company",
"type": "plan-assignment",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-update-allow",
"request": {
"id": "check:tenant-engine-update-t1",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.update",
"resource": {
"id": "tenant:friendly:binky",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-retire-allow",
"request": {
"id": "check:tenant-engine-retire-t1",
"tenant": "tenant:acme:prod",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.retire",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-reactivate-allow",
"request": {
"id": "check:tenant-engine-reactivate-t1",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.reactivate",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-update-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-update-t1",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "some-other-service",
"type": "service"
},
"action": "tenant.update",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-retire-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-retire-t1",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "some-other-service",
"type": "service"
},
"action": "tenant.retire",
"resource": {
"id": "tenant:friendly:binky",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-reactivate-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-reactivate-t1",
"tenant": "tenant:acme:prod",
"subject": {
"id": "some-other-service",
"type": "service"
},
"action": "tenant.reactivate",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-misspelled-lifecycle-action-deny",
"request": {
"id": "check:tenant-engine-retired-t1",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.retired",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_action"
}
},
{
"id": "fixture:tenant-engine-lifecycle-underscore-action-deny",
"request": {
"id": "check:tenant-engine-underscore-t1",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant_update",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_action"
}
},
{
"id": "fixture:tenant-engine-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-create-t1",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "some-other-service",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:friendly:binky",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-wrong-system-deny",
"request": {
"id": "check:tenant-engine-create-t1",
"tenant": "tenant:acme:prod",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "some-other-system"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "wrong_system"
}
},
{
"id": "fixture:tenant-engine-unknown-action-deny",
"request": {
"id": "check:tenant-engine-delete-t1",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.delete",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_action"
}
},
{
"id": "fixture:tenant-engine-wrong-subject-type-deny",
"request": {
"id": "check:tenant-engine-create-t1",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "tenant-engine",
"type": "human"
},
"action": "tenant.create",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "wrong_subject_type"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-pdp-allow",
"request": {
"id": "check:tenant-engine-guardrail-read-pdp",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:friendly:binky",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-writer-allow",
"request": {
"id": "check:tenant-engine-guardrail-read-writer",
"tenant": "tenant:acme:prod",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:acme:prod",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-guardrail-set-writer-allow",
"request": {
"id": "check:tenant-engine-guardrail-set-writer",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.guardrail.set",
"resource": {
"id": "tenant:platform",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-guardrail-set-pdp-deny",
"request": {
"id": "check:tenant-engine-guardrail-set-pdp",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.set",
"resource": {
"id": "tenant:trial:demo-company",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-guardrail-read-ops",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "ops",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:friendly:binky",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
"request": {
"id": "check:tenant-engine-guardrail-set-ops",
"tenant": "tenant:acme:prod",
"subject": {
"id": "ops",
"type": "service"
},
"action": "tenant.guardrail.set",
"resource": {
"id": "tenant:acme:prod",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_subject"
}
},
{
"id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
"request": {
"id": "check:tenant-engine-guardrail-get",
"tenant": "tenant:platform",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.get",
"resource": {
"id": "tenant:platform",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "unknown_action"
}
},
{
"id": "fixture:tenant-engine-portal-create",
"request": {
"id": "check:portal-create",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-portal-read",
"request": {
"id": "check:portal-read",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.read",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-portal-platform-create",
"request": {
"id": "check:portal-platform-create",
"tenant": "tenant:platform",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-platform-read",
"request": {
"id": "check:portal-platform-read",
"tenant": "tenant:platform",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.read",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-role-grant",
"request": {
"id": "check:portal-role-grant",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.role.grant",
"resource": {
"id": "tenant:trial:demo-company",
"type": "role-grant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-role-revoke",
"request": {
"id": "check:portal-role-revoke",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.role.revoke",
"resource": {
"id": "tenant:trial:demo-company",
"type": "role-grant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-plan-assign",
"request": {
"id": "check:portal-plan-assign",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.plan.assign",
"resource": {
"id": "tenant:trial:demo-company",
"type": "plan-assignment",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-update",
"request": {
"id": "check:portal-update",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.update",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-retire",
"request": {
"id": "check:portal-retire",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.retire",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-reactivate",
"request": {
"id": "check:portal-reactivate",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.reactivate",
"resource": {
"id": "tenant:trial:demo-company",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-guardrail-read",
"request": {
"id": "check:portal-guardrail-read",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:trial:demo-company",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-portal-guardrail-set",
"request": {
"id": "check:portal-guardrail-set",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "user-engine",
"type": "service"
},
"action": "tenant.guardrail.set",
"resource": {
"id": "tenant:trial:demo-company",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "action_not_granted"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-pdp-cross-tenant-platform-allow",
"request": {
"id": "check:guardrail-read-pdp-tenant:platform",
"tenant": "tenant:platform",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:platform",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-pdp-cross-tenant-acme-prod-allow",
"request": {
"id": "check:guardrail-read-pdp-tenant:acme:prod",
"tenant": "tenant:acme:prod",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:acme:prod",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-guardrail-read-pdp-cross-tenant-trial-demo-company-allow",
"request": {
"id": "check:guardrail-read-pdp-tenant:trial:demo-company",
"tenant": "tenant:trial:demo-company",
"subject": {
"id": "flex-auth",
"type": "service"
},
"action": "tenant.guardrail.read",
"resource": {
"id": "tenant:trial:demo-company",
"type": "guardrail",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-create-cross-tenant-platform-allow",
"request": {
"id": "check:create-tenant:platform",
"tenant": "tenant:platform",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:platform",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-create-cross-tenant-acme-prod-allow",
"request": {
"id": "check:create-tenant:acme:prod",
"tenant": "tenant:acme:prod",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "allow",
"reason": "write_api_policy_matched"
}
},
{
"id": "fixture:tenant-engine-tenant-not-target-deny",
"request": {
"id": "check:tenant-not-target",
"tenant": "tenant:friendly:binky",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "tenant_not_target"
}
},
{
"id": "fixture:tenant-engine-tenant-absent-deny",
"request": {
"id": "check:tenant-absent",
"subject": {
"id": "tenant-engine",
"type": "service"
},
"action": "tenant.create",
"resource": {
"id": "tenant:acme:prod",
"type": "tenant",
"system": "tenant-engine"
},
"context": {}
},
"expect": {
"effect": "deny",
"reason": "tenant_not_target"
}
}
]
Reference in a new issue View git blame Copy permalink