tegwick
f304688d72
FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.
283 lines
6.7 KiB
JSON
283 lines
6.7 KiB
JSON
{
|
|
"systems": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"name": "Tenant Engine",
|
|
"resource_types": [
|
|
{
|
|
"name": "tenant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant record (existence, onboarding grouping)."
|
|
}
|
|
},
|
|
{
|
|
"name": "role-grant",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A capability-role grant or revocation (PLTF/IAM/VEN/CUS)."
|
|
}
|
|
},
|
|
{
|
|
"name": "plan-assignment",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant's plan/subscription assignment (by reference id)."
|
|
}
|
|
},
|
|
{
|
|
"name": "guardrail",
|
|
"scope_level": "Resource",
|
|
"planes": [
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"metadata": {
|
|
"description": "A tenant's resolved ceiling (spend, seats, and similar limits) plus the provenance of that value. Not an entitlement and not a meter."
|
|
}
|
|
}
|
|
],
|
|
"actions": [
|
|
{
|
|
"name": "tenant.create",
|
|
"capabilities": [
|
|
"Create",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.grant",
|
|
"capabilities": [
|
|
"Grant",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.role.revoke",
|
|
"capabilities": [
|
|
"Revoke",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.plan.assign",
|
|
"capabilities": [
|
|
"Bind",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.update",
|
|
"capabilities": [
|
|
"EditAny",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.retire",
|
|
"capabilities": [
|
|
"Archive",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.reactivate",
|
|
"capabilities": [
|
|
"Restore",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Identity",
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.guardrail.read",
|
|
"capabilities": [
|
|
"View",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
},
|
|
{
|
|
"name": "tenant.guardrail.set",
|
|
"capabilities": [
|
|
"EditAny",
|
|
"Audit"
|
|
],
|
|
"planes": [
|
|
"Policy",
|
|
"Audit"
|
|
],
|
|
"exposure_modes": [
|
|
"Metadata"
|
|
],
|
|
"metadata": {
|
|
"required_context": []
|
|
}
|
|
}
|
|
],
|
|
"caring_profiles": [
|
|
"caring-0.4.0-rc2"
|
|
],
|
|
"metadata": {
|
|
"flex_auth_contract": "protected-system-v0",
|
|
"boundary_contract": "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
|
|
}
|
|
}
|
|
],
|
|
"resource_manifests": [],
|
|
"tenants": [
|
|
{
|
|
"id": "tenant:platform",
|
|
"name": "Platform Tenant"
|
|
}
|
|
],
|
|
"subjects": [
|
|
{
|
|
"id": "tenant-engine",
|
|
"type": "Service",
|
|
"display_name": "tenant-engine service principal",
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
],
|
|
"groups": [
|
|
"group:tenant-engine-writers",
|
|
"group:tenant-engine-readers"
|
|
],
|
|
"tenant": "tenant:platform",
|
|
"metadata": {
|
|
"description": "tenant-engine's own service identity, used for the nine write-API actions it sends to POST /v1/check (authz.FlexAuthWriteAuthorizer): tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign, the lifecycle actions tenant.update, tenant.retire, tenant.reactivate, and the guardrail actions tenant.guardrail.read, tenant.guardrail.set."
|
|
}
|
|
},
|
|
{
|
|
"id": "flex-auth",
|
|
"type": "Service",
|
|
"display_name": "flex-auth service principal",
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
],
|
|
"groups": [
|
|
"group:tenant-engine-readers"
|
|
],
|
|
"tenant": "tenant:platform",
|
|
"metadata": {
|
|
"description": "flex-auth's own service identity. Authorized only for tenant.guardrail.read so the PDP can consume ceilings without being able to change them (FLEX-WP-0014)."
|
|
}
|
|
}
|
|
],
|
|
"groups": [
|
|
{
|
|
"id": "group:tenant-engine-writers",
|
|
"display_name": "tenant-engine Write API Callers",
|
|
"members": [
|
|
"tenant-engine"
|
|
],
|
|
"tenant": "tenant:platform"
|
|
},
|
|
{
|
|
"id": "group:tenant-engine-readers",
|
|
"display_name": "tenant-engine Guardrail Readers",
|
|
"members": [
|
|
"flex-auth",
|
|
"tenant-engine"
|
|
],
|
|
"tenant": "tenant:platform"
|
|
}
|
|
],
|
|
"relationships": []
|
|
}
|