tegwick
06dfe12c18
Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call. Assistant: grok Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
22 lines
939 B
Markdown
22 lines
939 B
Markdown
# Use claim consumed by secrets-engine
|
|
|
|
Permission to start or call one secrets-engine stage instance is an
|
|
access-engine decision. This engine consumes that claim. It does not decide it
|
|
and it does not store a credential for it.
|
|
|
|
## Claim
|
|
|
|
- Decider: access-engine.
|
|
- Subject: an operator allowed to use one stage instance.
|
|
- Object: one secrets-engine process bound to exactly one stage.
|
|
- Stage: `build`, `test`, or `production`.
|
|
- Action: use.
|
|
- Effect: the operator may call that instance for the bound stage.
|
|
|
|
The stage credential is injected into the process at start and stays there.
|
|
Use of the instance does not confer that credential. Delegation of a task
|
|
transfers neither the use decision nor the injected credential.
|
|
|
|
`--allow` and `SECRETS_ENGINE_LOCAL_ALLOW` are not this claim. They do not
|
|
authorize apply or the service. A protected side effect still requires a
|
|
decision record or the published unreachable-engine stance.
|