tegwick
8e127e50f7
Extend the tenant-engine write-API policy package with tenant.update, tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005 introduced. Until now every lifecycle mutation resolved to deny unknown_action, blocking TEN-WP-0005-T05 production rollout. - policy_package.md: three actions in valid_actions and frontmatter; CARING capabilities extended with EditAny/Archive/Restore - protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt registry_snapshot.json carry all seven actions - docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces - 8 new fixture pairs and 5 new Rego tests, including action-drift guards (tenant.retired, tenant_update -> unknown_action) T02 decision, recorded in policy_package.md: tenant.retire does NOT get stricter authorization yet. With one service subject and no assurance claim in the CheckRequest there is nothing stricter to check, and a condition the sole caller always satisfies would falsely read as separate control. Retirement is reversible and non-destructive. Revisit on KEY-WP-0005 assurance claims or a second operator subject. Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt and go vet clean. End-to-end against a live serve with a real tenant-engine through the unmodified FlexAuthWriteAuthorizer: update 6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970 all allow; unregistered actor denied unknown_subject (59d3e99c6416be89, 403 write_denied). Handoff revision for TEN-WP-0005-T05: package tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
112 lines
2.2 KiB
YAML
112 lines
2.2 KiB
YAML
id: tenant-engine
|
|
name: Tenant Engine
|
|
resource_types:
|
|
- name: tenant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant record (existence, onboarding grouping).
|
|
- name: role-grant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
metadata:
|
|
description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
|
|
- name: plan-assignment
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant's plan/subscription assignment (by reference id).
|
|
actions:
|
|
- name: tenant.create
|
|
capabilities:
|
|
- Create
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.grant
|
|
capabilities:
|
|
- Grant
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.revoke
|
|
capabilities:
|
|
- Revoke
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.plan.assign
|
|
capabilities:
|
|
- Bind
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.update
|
|
capabilities:
|
|
- EditAny
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.retire
|
|
capabilities:
|
|
- Archive
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.reactivate
|
|
capabilities:
|
|
- Restore
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
caring_profiles:
|
|
- caring-0.4.0-rc2
|
|
metadata:
|
|
flex_auth_contract: protected-system-v0
|
|
boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md
|