tegwick
49de2f40ff
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.
examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.
Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.
Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.
T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
159 lines
3.6 KiB
JSON
159 lines
3.6 KiB
JSON
{
|
|
"systems": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"name": "Tenant Engine",
|
|
"resource_types": [
|
|
{
|
|
"name": "tenant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant record (existence, onboarding grouping)."
|
|
}
|
|
},
|
|
{
|
|
"name": "role-grant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
|
|
}
|
|
},
|
|
{
|
|
"name": "plan-assignment",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant's plan/subscription assignment (by reference id)."
|
|
}
|
|
}
|
|
],
|
|
"actions": [
|
|
{
|
|
"name": "tenant.create",
|
|
"capabilities": [
|
|
"Create",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.grant",
|
|
"capabilities": [
|
|
"Grant",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.revoke",
|
|
"capabilities": [
|
|
"Revoke",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.plan.assign",
|
|
"capabilities": [
|
|
"Bind",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
}
|
|
],
|
|
"caring_profiles": [
|
|
"caring-0.4.0-rc2"
|
|
],
|
|
"metadata": {
|
|
"flex_auth_contract": "protected-system-v0",
|
|
"boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
|
|
}
|
|
}
|
|
],
|
|
"resource_manifests": [],
|
|
"tenants": [
|
|
{
|
|
"id": "tenant:platform",
|
|
"name": "Platform Tenant"
|
|
}
|
|
],
|
|
"subjects": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"type": "Service",
|
|
"display_name": "tenant-engine service principal",
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
],
|
|
"groups": [
|
|
"group:tenant-engine-writers"
|
|
],
|
|
"tenant": "tenant:platform",
|
|
"metadata": {
|
|
"description": "tenant-engine's own service identity, used for the tenant.create / tenant.role.grant / tenant.role.revoke / tenant.plan.assign actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer)."
|
|
}
|
|
}
|
|
],
|
|
"groups": [
|
|
{
|
|
"id": "group:tenant-engine-writers",
|
|
"display_name": "tenant-engine Write API Callers",
|
|
"members": [
|
|
"tenant-engine"
|
|
],
|
|
"tenant": "tenant:platform"
|
|
}
|
|
],
|
|
"relationships": []
|
|
}
|