coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/docs/tenant-engine-resource-namespace.md
tegwick 49de2f40ff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package 
docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions
(tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign)
matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping
exactly. No resource_manifest.yaml -- tenant-engine's resources are created
dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented
as a deliberate deviation.

examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml
(one registered caller: tenant-engine's own service identity),
policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8
allow/deny pairs), assembled registry_snapshot.json, two standalone
check_request examples, README.

Design decision made explicit in the workplan: operator/service-identity
authorization (one known subject, four known actions), not aal2+assurance +
tenant-capability-role checking -- CheckRequest carries no assurance claim
yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a
real auth context), and a tenant's capability roles are the tenant's own
state, not a property of who may call tenant-engine's admin API. Revisit
once KEY-WP-0005 gives callers a real assurance-bearing identity.

Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8
fixtures, all pass), load-registry, check against both example requests.
Then ran a live flex-auth serve with this exact registry+policy and pointed
tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer
at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test
./... still green across the whole repo.

T03 (live-lookup context adapter for other protected systems) stays open --
new Go adapter package, tracked separately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 23:05:57 +02:00

1.8 KiB
Raw Blame History

tenant-engine Resource Namespace

This document defines the tenant-engine protected-system namespace consumed by flex-auth (FLEX-WP-0008-T01).

Unlike Markitect's document hierarchy or ops-warden's fixed SSH-certificate inventory, tenant-engine's resources (tenants, their role grants, their plan assignments) are created dynamically — there is no fixed, pre-registrable resource list to publish a resource_manifest.yaml for. Every CheckRequest carries the resource identity inline (resource.id == tenant_id), and the policy evaluates against input directly rather than looking up a registered resource by id. This is a deliberate, documented deviation from the ops-warden pattern, not an omission.

Resource Types

tenant            -- a tenant record (existence, grouping)
role-grant        -- a capability-role grant/revocation
plan-assignment   -- a tenant's plan/subscription assignment

All three are scope_level: Resource, always accessed within system: tenant-engine.

Ownership Boundary

tenant-engine's own boundary contract (net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md) already defines these as tenant-engine's owned resource kinds. This namespace only maps that ownership into flex-auth's protected-system vocabulary — it does not redefine ownership.

Related

  • docs/tenant-engine-action-vocabulary.md — the actions gated on these resource types
  • examples/tenant-engine/ — protected-system manifest, subject manifest, policy package, and fixtures
  • net-kingdom/docs/adr/ADR-0014-tenant-capability-roles-and-tenant-engine-ownership.md — the capability-role model (PLTF/IAM/VEN/CUS) these resources carry as tenant state, distinct from the operator authorization this namespace governs (who may call tenant-engine's write API, not what a tenant is allowed to do)