51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
|
# tenant-engine — PEP unreachable-engine stance map
|
||
|
|
#
|
||
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
|
||
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2 §5
|
||
|
|
# Named from: layer.yaml (pep_stance)
|
||
|
|
# Validate: tests/test_layer_conformance.py
|
||
|
|
#
|
||
|
|
# tenant-engine's protected side effect is a mutation of tenant-as-an-entity
|
||
|
|
# facts (create, grant, revoke, plan, lifecycle, grouping, guardrail).
|
||
|
|
# This is not ops-warden's per-zone fail-open map. A PIP that cannot ask
|
||
|
|
# the PDP does not guess; it refuses.
|
||
|
|
|
||
|
|
schema_version: "0.1"
|
||
|
|
framework: netkingdom-security-layer-model
|
||
|
|
standard_version: "0.7"
|
||
|
|
repository: tenant-engine
|
||
|
|
pep_shape: true
|
||
|
|
declared_by: decisions/decisions.md#TEN-DEC-2026-001
|
||
|
|
|
||
|
|
protected_action: "mutation of tenant-as-an-entity facts"
|
||
|
|
decision_engine: access-engine
|
||
|
|
scope: engine-reachability
|
||
|
|
|
||
|
|
# Total by construction. No implicit default — an unlisted value is a
|
||
|
|
# config error, not a permissive fallback. Every scope fails closed.
|
||
|
|
stance:
|
||
|
|
unset: fail_closed # TENANT_ENGINE_FLEX_AUTH_URL is not set
|
||
|
|
unreachable: fail_closed # transport, timeout, non-2xx, malformed body
|
||
|
|
non_allow: fail_closed # a decision was rendered, effect was not allow
|
||
|
|
unknown: fail_closed
|
||
|
|
|
||
|
|
on_apply:
|
||
|
|
recorded_fields:
|
||
|
|
- authorization_source # decision | stance
|
||
|
|
- authorization_decision_id
|
||
|
|
- authorization_request_digest
|
||
|
|
- authorization_effect
|
||
|
|
- authorization_stance
|
||
|
|
- authorization_reason
|
||
|
|
- action
|
||
|
|
- tenant_id
|
||
|
|
- actor
|
||
|
|
- allowed
|
||
|
|
written_to:
|
||
|
|
- "authz_records (every authorize attempt)"
|
||
|
|
- "events.payload (successful mutations only)"
|
||
|
|
never_recorded: "tokens, secrets, request bodies beyond the check digest"
|
||
|
|
|
||
|
|
# §6.4 obligation 2 — the verdict is never cached. Every write re-checks.
|
||
|
|
verdict_caching: none
|