tegwick
f304688d72
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.
15 lines
300 B
JSON
15 lines
300 B
JSON
{
|
|
"id": "check:tenant-engine-guardrail-set-pdp",
|
|
"tenant": "tenant:friendly:binky",
|
|
"subject": {
|
|
"id": "flex-auth",
|
|
"type": "service"
|
|
},
|
|
"action": "tenant.guardrail.set",
|
|
"resource": {
|
|
"id": "t-1",
|
|
"type": "guardrail",
|
|
"system": "tenant-engine"
|
|
},
|
|
"context": {}
|
|
}
|