tegwick
9f3e7e363a
approval-engine suggested a conformance check after the examples-contradict- prose class hit a third repository -- theirs. Fifteen lines, they said, and it would have caught our caring fixture and our provenance omission. Worth stealing, so we stole it. internal/schemaguard validates published examples against published schemas. It implements only the JSON Schema subset these schemas use, and the property that makes it trustworthy is that an unrecognised keyword FAILS rather than skips: a validator that silently approves what it does not understand invites reliance it cannot support. It found three things on first run. ONE, AND THE LARGEST: check_request.schema.json pointed subject.type at CARING's subject_type enum (Human, Service, ...), and no consumer sends that vocabulary. user-engine sends human, tenant-engine and secrets-engine send service, and ops-warden sends adm/agt/atm -- an actor-type vocabulary CARING does not model at all. Our published schema declared three live integrations non-conformant. A rule that outlaws shipped correct behaviour is the rule that is wrong, so the $ref is replaced with an opaque non-empty string and a description saying why. CARING's enum remains correct where it belongs: the registry's subject_manifest.yaml, where Service is right. TWO: policy_package_note, which this session added to the caring example's decision provenance, is undeclared under additionalProperties:false. Our own annotation broke the conformance it was annotating. Moved to the envelope's outer provenance. THREE: the secrets-engine fixtures carried partial approval-claims, missing binding, freshness and validity. A partial claim in a fixture is how a consumer learns the wrong shape -- the same mechanism that produced the destroy defect. They are now complete and valid against approval-engine's schema, including the now-required binding.pdp_digest, and a test validates them against that schema when the sibling repo is present. The destroy replay fixture is regenerated accordingly and the replay README's pinned digests updated, since a stale digest table is the same defect wearing a different hat. Closed the binding-mapping open item. approval-engine declined to publish a vocabulary mapping and their reasoning is better than the request: a PIP asserting secrets.kv.destroy MEANS destroy would author semantics over two vocabularies it owns neither of, and a wrong mapping silently accepts a claim approved for a different action. pdp_digest is the mapping precisely because it does not translate. It is now always present and nullable, so the destroy gate is pdp_digest non-null and equal, enforced at the PEP. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB Assistant: claude-code Assistant-Model: opus Assistant-Process: 412054@bnt-lap001 Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19
1054 lines
27 KiB
YAML
1054 lines
27 KiB
YAML
[
|
|
{
|
|
"id": "fixture:secrets-engine-apply-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-apply",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "apply",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-provision-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-provision",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "provision",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-rotate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-verify-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-verify",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "verify",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-handoff-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-handoff",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "handoff",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrap-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-wrap",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "wrap",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-exec-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-exec",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "exec",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-deactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-deactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "deactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-suspend-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-suspend",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "suspend",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-compromise-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-compromise",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "compromise",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-reactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-reactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "reactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-dual-control-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-no-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-insufficient-approvers-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "requested",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "insufficient_approvers"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-consumed-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "consumed",
|
|
"valid_now": false,
|
|
"consumed": true,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "consumed"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-revoked-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "revoked",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "revoked"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-approved-not-valid-now-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "approved",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "not_yet_valid"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-foreign-issuer-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "some-other-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-wrong-kind-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "action-authorization",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-revoke-not-an-action-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-revoke",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "revoke",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-plan-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-plan",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "plan",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-route-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-route",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "route",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-audit-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-audit",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "audit",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-catalog-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-catalog",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "catalog",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-evidence-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-evidence",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "evidence",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "some-other-service",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_subject"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-subject-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "human"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_subject_type"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-system-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "some-other-system",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_system"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-resource-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_resource_type"
|
|
}
|
|
}
|
|
]
|