tegwick
8e127e50f7
Extend the tenant-engine write-API policy package with tenant.update, tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005 introduced. Until now every lifecycle mutation resolved to deny unknown_action, blocking TEN-WP-0005-T05 production rollout. - policy_package.md: three actions in valid_actions and frontmatter; CARING capabilities extended with EditAny/Archive/Restore - protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt registry_snapshot.json carry all seven actions - docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces - 8 new fixture pairs and 5 new Rego tests, including action-drift guards (tenant.retired, tenant_update -> unknown_action) T02 decision, recorded in policy_package.md: tenant.retire does NOT get stricter authorization yet. With one service subject and no assurance claim in the CheckRequest there is nothing stricter to check, and a condition the sole caller always satisfies would falsely read as separate control. Retirement is reversible and non-destructive. Revisit on KEY-WP-0005 assurance claims or a second operator subject. Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt and go vet clean. End-to-end against a live serve with a real tenant-engine through the unmodified FlexAuthWriteAuthorizer: update 6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970 all allow; unregistered actor denied unknown_subject (59d3e99c6416be89, 403 write_denied). Handoff revision for TEN-WP-0005-T05: package tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
27 lines
860 B
YAML
27 lines
860 B
YAML
id: subjects:tenant-engine-operators
|
|
tenants:
|
|
- id: tenant:platform
|
|
name: Platform Tenant
|
|
subjects:
|
|
- id: tenant-engine
|
|
type: Service
|
|
display_name: tenant-engine service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-writers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
tenant-engine's own service identity, used for the seven write-API
|
|
actions it sends to POST /v1/check
|
|
(authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
|
|
tenant.role.revoke, tenant.plan.assign, and the lifecycle actions
|
|
tenant.update, tenant.retire, tenant.reactivate.
|
|
groups:
|
|
- id: group:tenant-engine-writers
|
|
display_name: tenant-engine Write API Callers
|
|
members:
|
|
- tenant-engine
|
|
tenant: tenant:platform
|