tegwick
d98323b2bb
secrets-engine.catalog-lane.lifecycle v1 contained no reference to input.tenant — not in well_formed, not in the denial ladder, not in a test. A rotate on lane:glas-primary under tenant:coulomb returned allow against the deployed package (decision:066e629bbf0c0924). Found while answering glas-harness's tenant-alignment request, which had asked for wrong-tenant denial evidence. There was none to return. Three covers failed the same way: every one of the 29 fixtures carried tenant:platform, so the suite could not report on the field; T02's own gate named "wrong-tenant deny" and was recorded done unmet; and the engine hashes tenant into request_digest but never compares it. Four other published packages carry the branch — this one was the outlier. v2 adds wrong_tenant above wrong_system, three Rego tests and three fixtures (28/28, 32/32). The absent-tenant test caught a second defect in the first draft: a bare input.tenant != comparison is undefined on a missing key, so the branch dropped and the ladder reported the wrong rung. request_tenant := object.get(input, "tenant", "") fixes it. v2 supersedes rather than amends v1 because the defect failed open: a consumer pinned to _VERSION=v1 would keep receiving allows with no signal the rule beneath the version string had changed. The earlier dual-control correction stayed at v1 because it denied everything. Replay envelopes regenerated at v2; both request_digest values are byte-identical, so secrets-engine's digest join needs no re-pinning. The sweep this prompted found tenant-engine unscoped on tenant as well — deployed, and verified allowing tenant:coulomb. Not the same fix: its request tenant names the target rather than the caller, so a constant would break it. Recorded and carried by FLEX-WP-0022 rather than patched unilaterally. FLEX-WP-0021 closes at T05; the pin still serves v1 until a redeploy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014aQMM1dPXaPiXVn6DwwtLd Assistant: claude-code Assistant-Model: opus Assistant-Process: 715613@bnt-lap001 Assistant-Session: fabd95c1-4c9e-4080-8849-8707ae025f80
1181 lines
31 KiB
YAML
1181 lines
31 KiB
YAML
[
|
|
{
|
|
"id": "fixture:secrets-engine-apply-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-apply",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "apply",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-provision-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-provision",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "provision",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-rotate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-verify-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-verify",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "verify",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-handoff-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-handoff",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "handoff",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrap-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-wrap",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "wrap",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-exec-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-exec",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "exec",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-deactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-deactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "deactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-suspend-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-suspend",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "suspend",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-compromise-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-compromise",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "compromise",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-reactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-reactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "reactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-dual-control-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-no-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-insufficient-approvers-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "requested",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "insufficient_approvers"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-consumed-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "consumed",
|
|
"valid_now": false,
|
|
"consumed": true,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "consumed"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-revoked-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "revoked",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "revoked"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-approved-not-valid-now-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "approved",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "not_yet_valid"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-foreign-issuer-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "some-other-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-wrong-kind-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "action-authorization",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-revoke-not-an-action-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-revoke",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "revoke",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-plan-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-plan",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "plan",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-route-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-route",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "route",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-audit-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-audit",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "audit",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-catalog-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-catalog",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "catalog",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-evidence-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-evidence",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "evidence",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "some-other-service",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_subject"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-subject-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "human"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_subject_type"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-system-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "some-other-system",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_system"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-resource-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_resource_type"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-tenant-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-wrong-tenant",
|
|
"tenant": "tenant:coulomb",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_tenant"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-absent-tenant-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-absent-tenant",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_tenant"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-tenant-with-valid-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-wrong-tenant-dual-control",
|
|
"tenant": "tenant:coulomb",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_tenant"
|
|
}
|
|
}
|
|
]
|