tegwick
80eafafe5b
build_action_request emitted no tenant field at all. The deployed secrets-engine.catalog-lane.lifecycle v2 package reads known_tenant := "tenant:platform" request_tenant := object.get(input, "tenant", "") so an absent tenant is not an ignored field, it matches the wrong_tenant first-denial branch. Every gated action this engine sent would have been denied -- and the omission also produced a request_digest that could match no correctly issued decision, since tenant is hashed material. That is the same class of defect as hashing excluded fields, arriving from the other direction, and again only a real artifact exposed it. Found by answering the GLAS-WP-0015 tenant-alignment question instead of assuming the values lined up. - REQUEST_TENANT is pinned against the vendored allow envelopes, so a package retenanting fails a test rather than denying production. - An empty tenant is refused at build time. - Accepted policy version moves v1 -> v2. v1 had no tenant rule and failed open: a rotate under tenant:coulomb returned allow against the deployed package. flex-auth superseded rather than amended it, because a fail-open correction has to be visible as a version change. A test pins that a v1 decision is refused. - Vendored decision_wrong_tenant_deny.json as the denial evidence glas asked for, with tests that we refuse it on effect before anything else and that a deny legally carries no lifetime. docs/tenant-alignment.md states the three tenant values as this repo holds them. It does not resolve the JWT/store mapping: service_auth.TENANT is tenant:coulomb, which is exactly the value the package denies. That is either two layers sharing a namespace format or one wrong constant, and picking between them without an owner ruling is the fail-open shape GH-DEC-2026-008 rejected for action vocabularies. Both constants stay as they are, deliberately not unified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij Assistant: claude-code Assistant-Model: opus Assistant-Process: 715726@bnt-lap001 Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092
144 lines
4.8 KiB
JSON
144 lines
4.8 KiB
JSON
{
|
|
"id": "decision:4e327202e2aee41c",
|
|
"contract_version": "flex-auth.decision-record.v1",
|
|
"request_id": "check:secrets-engine-destroy",
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched",
|
|
"matched_policy_version": "v2",
|
|
"matched_rule": "catalog_lane_policy_matched",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"auth_targets": [],
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
|
"display_name": "secrets-engine service principal",
|
|
"groups": [
|
|
"group:secrets-engine-lane-operators"
|
|
],
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
]
|
|
}
|
|
},
|
|
"binding": {
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
|
"display_name": "secrets-engine service principal",
|
|
"groups": [
|
|
"group:secrets-engine-lane-operators"
|
|
],
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
]
|
|
}
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"auth_targets": [],
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"actor": "agt-secrets-engine",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true,
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"consumed": false,
|
|
"freshness": {
|
|
"not_after": "2026-09-06T12:00:30+00:00",
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30
|
|
},
|
|
"issuer": "approval-engine",
|
|
"kind": "approval-claim",
|
|
"reason_code": "ok",
|
|
"schema_version": "0.1",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"validity": {
|
|
"expires_at": "2026-09-06T15:00:00+00:00",
|
|
"not_before": "2026-09-06T11:00:00+00:00"
|
|
}
|
|
}
|
|
},
|
|
"request_digest": "sha256:c749ee2dc3cdf927a70a3e5b27cff4d97a438d3264153b4b2e3bcacbaf82091a",
|
|
"approval_binding_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56"
|
|
},
|
|
"lifetime": {
|
|
"kind": "ttl",
|
|
"ttl": "15m",
|
|
"not_before": "2026-09-06T18:35:19Z",
|
|
"expires_at": "2026-09-06T18:50:19Z"
|
|
},
|
|
"diagnostics": {
|
|
"action": "destroy",
|
|
"matched_relationship": "",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_status": "ready",
|
|
"registry_resource": false,
|
|
"registry_subject": true
|
|
},
|
|
"provenance": {
|
|
"evaluator": "flex-auth/local",
|
|
"mode": "standalone",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_version": "v2",
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
|
"input_claim_digests": {
|
|
"context": "sha256:8b73d29ecef286d42e03d2420531d6c45219f325a7ae004c1ecfc781203a2800"
|
|
},
|
|
"decision_time": "2026-09-06T18:35:19Z"
|
|
},
|
|
"caring": {
|
|
"profile": "caring-0.4.0-rc2",
|
|
"conformance_findings": [
|
|
{
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
|
"severity": "warning",
|
|
"message": "no CARING descriptor matched the request",
|
|
"fields": [
|
|
"caring_context"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|