coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/engine-use-claim.md
tegwick 06dfe12c18
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Manifest the lifecycle engine as a library, a one-stage CLI, and an in-process service. 
Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
2026-10-22 18:02:21 +02:00

939 B
Raw Blame History

Use claim consumed by secrets-engine

Permission to start or call one secrets-engine stage instance is an access-engine decision. This engine consumes that claim. It does not decide it and it does not store a credential for it.

Claim

  • Decider: access-engine.
  • Subject: an operator allowed to use one stage instance.
  • Object: one secrets-engine process bound to exactly one stage.
  • Stage: build, test, or production.
  • Action: use.
  • Effect: the operator may call that instance for the bound stage.

The stage credential is injected into the process at start and stays there. Use of the instance does not confer that credential. Delegation of a task transfers neither the use decision nor the injected credential.

--allow and SECRETS_ENGINE_LOCAL_ALLOW are not this claim. They do not authorize apply or the service. A protected side effect still requires a decision record or the published unreachable-engine stance.