tegwick
ae295824bd
QONTO-WP-0004-T04. Modeled directly on examples/tenant-engine/: one resource type (finance-snapshot), one action (finance.qonto.read), two registered subjects (an agent-harness session identity and the founder's human identity), and a Rego policy gating on resource.system + action + subject.type + tenant match. Tenant capability-role/plan liveness (VEN/CUS) is deliberately NOT encoded here -- that's qonto-assistant's separate tenant-engine live-lookup check, per this package's own scope note. Verified: flex-auth test-policy (6 rego tests + 6 fixtures, all pass), load-registry, and CLI check for both an allow and a deny case. Also verified end-to-end over real HTTP: a live flex-auth serve loaded with this exact registry+policy, hit by qonto-assistant's actual FlexAuthCheckClient (not a mock) -- allow for tenant:friendly:binky, deny (wrong_tenant) for a mismatched tenant. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
333 B
JSON
15 lines
333 B
JSON
{
|
|
"id": "check:qonto-assistant-read-t6",
|
|
"tenant": "tenant:friendly:some-other-company",
|
|
"subject": {
|
|
"id": "agent-harness-binky",
|
|
"type": "agent"
|
|
},
|
|
"action": "finance.qonto.read",
|
|
"resource": {
|
|
"id": "finance-snapshot",
|
|
"type": "finance-snapshot",
|
|
"system": "qonto-assistant"
|
|
},
|
|
"context": {}
|
|
}
|