23 lines
939 B
Markdown
23 lines
939 B
Markdown
|
# Use claim consumed by secrets-engine
|
||
|
|
|
||
|
|
Permission to start or call one secrets-engine stage instance is an
|
||
|
|
access-engine decision. This engine consumes that claim. It does not decide it
|
||
|
|
and it does not store a credential for it.
|
||
|
|
|
||
|
|
## Claim
|
||
|
|
|
||
|
|
- Decider: access-engine.
|
||
|
|
- Subject: an operator allowed to use one stage instance.
|
||
|
|
- Object: one secrets-engine process bound to exactly one stage.
|
||
|
|
- Stage: `build`, `test`, or `production`.
|
||
|
|
- Action: use.
|
||
|
|
- Effect: the operator may call that instance for the bound stage.
|
||
|
|
|
||
|
|
The stage credential is injected into the process at start and stays there.
|
||
|
|
Use of the instance does not confer that credential. Delegation of a task
|
||
|
|
transfers neither the use decision nor the injected credential.
|
||
|
|
|
||
|
|
`--allow` and `SECRETS_ENGINE_LOCAL_ALLOW` are not this claim. They do not
|
||
|
|
authorize apply or the service. A protected side effect still requires a
|
||
|
|
decision record or the published unreachable-engine stance.
|