tegwick
f304688d72
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.
49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
id: subjects:tenant-engine-operators
|
|
tenants:
|
|
- id: tenant:platform
|
|
name: Platform Tenant
|
|
subjects:
|
|
- id: tenant-engine
|
|
type: Service
|
|
display_name: tenant-engine service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-writers
|
|
- group:tenant-engine-readers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
tenant-engine's own service identity, used for the nine write-API
|
|
actions it sends to POST /v1/check
|
|
(authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant,
|
|
tenant.role.revoke, tenant.plan.assign, the lifecycle actions
|
|
tenant.update, tenant.retire, tenant.reactivate, and the
|
|
guardrail actions tenant.guardrail.read, tenant.guardrail.set.
|
|
- id: flex-auth
|
|
type: Service
|
|
display_name: flex-auth service principal
|
|
organization_relation: ServiceProvider
|
|
roles:
|
|
- Operator
|
|
groups:
|
|
- group:tenant-engine-readers
|
|
tenant: tenant:platform
|
|
metadata:
|
|
description: >-
|
|
flex-auth's own service identity. Authorized only for
|
|
tenant.guardrail.read so the PDP can consume ceilings without
|
|
being able to change them (FLEX-WP-0014).
|
|
groups:
|
|
- id: group:tenant-engine-writers
|
|
display_name: tenant-engine Write API Callers
|
|
members:
|
|
- tenant-engine
|
|
tenant: tenant:platform
|
|
- id: group:tenant-engine-readers
|
|
display_name: tenant-engine Guardrail Readers
|
|
members:
|
|
- flex-auth
|
|
- tenant-engine
|
|
tenant: tenant:platform
|