tegwick
ca563504c4
Warden failed closed on leftover JSON after a successful create. Objects are requested, no entries. Flex Auth package draft pins the seven ids; c01 skipped. No human bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
73 lines
2.9 KiB
Markdown
73 lines
2.9 KiB
Markdown
# Flex Auth package draft — compact sitting (seven records)
|
|
|
|
**Not admitted. Not served. Not an expansion of FLEX-WP-0027.**
|
|
Owner: flex-auth. Source pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
|
`c01` is absent (create-client still undecided).
|
|
|
|
Same identity bar as `examples/informed-decision-t03`. Deny every other
|
|
resource id. No consume.
|
|
|
|
```rego
|
|
import rego.v1
|
|
|
|
records := {
|
|
"memo:infd-20260914-c02": {
|
|
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
|
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
|
|
},
|
|
"memo:infd-20260914-c03": {
|
|
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
|
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
|
|
},
|
|
"memo:infd-20260914-c04": {
|
|
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
|
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
|
|
},
|
|
"memo:infd-20260914-d01": {
|
|
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
|
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
|
|
},
|
|
"memo:infd-20260914-d02": {
|
|
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
|
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
|
|
},
|
|
"memo:infd-20260914-d03": {
|
|
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
|
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
|
|
},
|
|
"memo:infd-20260914-d04": {
|
|
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
|
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
|
|
}
|
|
}
|
|
|
|
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
|
input.tenant == "tenant:platform"
|
|
input.subject.tenant == "tenant:platform"
|
|
input.subject.type == "human"
|
|
is_string(input.subject.id)
|
|
input.subject.id != ""
|
|
input.subject.attributes.principal_type_source == "authentication-derived"
|
|
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
|
"net-kingdom-admins" in input.subject.attributes.groups
|
|
assurance := input.subject.attributes.assurance
|
|
assurance.level == "aal2"
|
|
assurance.mfa == true
|
|
assurance.source == "key-cape"
|
|
assurance.methods == ["pwd", "otp"]
|
|
is_number(assurance.at)
|
|
age := time.now_ns() / 1000000000 - assurance.at
|
|
age >= -30
|
|
age <= 900
|
|
input.resource.tenant == "tenant:platform"
|
|
input.resource.system == "informed-decision"
|
|
input.resource.type == "decision-memo"
|
|
record := records[input.resource.id]
|
|
input.context.memo_version == 1
|
|
input.context.approval_id == record.approval_id
|
|
input.context.approval_binding_digest == record.binding_digest
|
|
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
|
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
|
true
|
|
}
|
|
```
|