tegwick
f304688d72
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.
143 lines
2.8 KiB
YAML
143 lines
2.8 KiB
YAML
id: tenant-engine
|
|
name: Tenant Engine
|
|
resource_types:
|
|
- name: tenant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant record (existence, onboarding grouping).
|
|
- name: role-grant
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
metadata:
|
|
description: A capability-role grant or revocation (PLTF/IAM/VEN/CUS).
|
|
- name: plan-assignment
|
|
scope_level: Resource
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
metadata:
|
|
description: A tenant's plan/subscription assignment (by reference id).
|
|
- name: guardrail
|
|
scope_level: Resource
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
metadata:
|
|
description: >-
|
|
A tenant's resolved ceiling (spend, seats, and similar limits) plus
|
|
the provenance of that value. Not an entitlement and not a meter.
|
|
actions:
|
|
- name: tenant.create
|
|
capabilities:
|
|
- Create
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.grant
|
|
capabilities:
|
|
- Grant
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.role.revoke
|
|
capabilities:
|
|
- Revoke
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.plan.assign
|
|
capabilities:
|
|
- Bind
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.update
|
|
capabilities:
|
|
- EditAny
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.retire
|
|
capabilities:
|
|
- Archive
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.reactivate
|
|
capabilities:
|
|
- Restore
|
|
- Audit
|
|
planes:
|
|
- Identity
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.guardrail.read
|
|
capabilities:
|
|
- View
|
|
- Audit
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
- name: tenant.guardrail.set
|
|
capabilities:
|
|
- EditAny
|
|
- Audit
|
|
planes:
|
|
- Policy
|
|
- Audit
|
|
exposure_modes:
|
|
- Metadata
|
|
metadata:
|
|
required_context: []
|
|
caring_profiles:
|
|
- caring-0.4.0-rc2
|
|
metadata:
|
|
flex_auth_contract: protected-system-v0
|
|
boundary_contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md
|