coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine

Browse source 
FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
tegwick 2026-10-10 15:28:05 +02:00
parent e2174cebaf
commit 1c2d0c2cf6
4 changed files with 49 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/tutorials/protected-system-flex-auth.md
View file

@ -19,7 +19,7 @@ back, and is refused when the caller is wrong.
## Prerequisites
- **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run
`go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`.
`go run ./cmd/access-engine`. Read `access-engine/docs/decision-record-contract.md`.
- **[owner: your system's repo]** A system id and a list of the things it
protects and the actions it performs on them.
- **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes
@ -53,10 +53,10 @@ consumer running with caller auth in `warn` mode is not protected.
fixtures covering every allow and every denial branch, including wrong
tenant, unknown subject and unknown action.
4. **[owner: flex-auth]** Validate and load offline:
`go run ./cmd/flex-auth validate -kind policy -file <policy_package.md>`
then `go run ./cmd/flex-auth load-registry -file <registry_snapshot.json>`.
`go run ./cmd/access-engine validate -kind policy -file <policy_package.md>`
then `go run ./cmd/access-engine load-registry -file <registry_snapshot.json>`.
5. **[owner: flex-auth]** Evaluate a check request locally:
`go run ./cmd/flex-auth check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
`go run ./cmd/access-engine check -registry <registry_snapshot.json> -policy <policy_package.md> -request <request.json>`.
A request is `tenant`, `subject`, `action`, `resource` and `context`. The
result is a decision envelope (`flex-auth.decision-record.v1`) with
`effect`, `reason`, and a deterministic decision `id`.