coulomb/tenant-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TEN-IN-0004 closed: repoint access-engine paths; TEN-DEC-2026-003 answers NK-WP-0039-T04

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 101414@bnt-lap001
Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6
This commit is contained in:
tegwick 2026-09-30 18:52:12 +02:00
parent 4ce89969c0
commit 6c137c1851
3 changed files with 62 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/flex-auth-integration.md
View file

@ -8,7 +8,7 @@ without a decision record or a recorded fail-closed stance
## What tenant-engine sends
A `CheckRequest` per `flex-auth/schemas/check_request.schema.json`:
A `CheckRequest` per `access-engine/schemas/check_request.schema.json`:
```json
{
@ -82,7 +82,7 @@ Action → resource-type mapping (must match `flex-auth`'s
## What tenant-engine expects back
A `DecisionEnvelope` per `flex-auth/schemas/decision_envelope.schema.json`.
A `DecisionEnvelope` per `access-engine/schemas/decision_envelope.schema.json`.
Only `effect: "allow"` authorizes the action. Every other `effect`, a
non-200 response, a malformed body, or a transport failure/timeout all
resolve to **deny**. `FlexAuthCheckClient.check()` never raises past its
@ -104,13 +104,13 @@ reads the store. That check does **not** re-enter tenant-engine:
2. `FlexAuthCheckClient` POSTs only `/v1/check`. Proven by
`tests/test_pip_claims.py::test_live_lookup_check_does_not_reenter_tenant_engine`.
3. flex-auth's tenant-engine policy package
(`flex-auth/examples/tenant-engine/policy_package.md`) matches
(`access-engine/examples/tenant-engine/policy_package.md`) matches
`subject.id` and `action` only. It does not consult tenant capability
roles. The package's own scope note says those roles are tenant state
a *different* protected system might consult via live-lookup;
conflating the two would authorize the wrong thing.
4. flex-auth's live-roles adapter is built and unwired
(`FLEX-WP-0015`, `flex-auth/docs/tenancy-posture-review.md`): no
(`FLEX-WP-0015`, `access-engine/docs/tenancy-posture-review.md`): no
non-test caller, no current policy consumes `tenant_roles` for a
privileged path.
@ -141,17 +141,17 @@ Tests assert the file equals shipped behaviour.
## Repository coordinate vs runtime name (TEN-IN-0004)
The `flex-auth` repository is renaming to `access-engine` (`FLEX-WP-0020`).
The `flex-auth` repository was renamed to `access-engine` (`FLEX-WP-0020`).
**Runtime names stay `flex-auth`** per `FLEX-DEC-2026-013`: the cluster
namespace, the `flex-auth-tenant-engine` Service, the token audience, and this
engine's `TENANT_ENGINE_FLEX_AUTH_*` settings are all unchanged by the rename.
Only the `flex-auth/...` repository paths cited below and above change, and
only once the rename lands.
Only the `flex-auth/...` repository paths cited below and above changed to
`access-engine/...` when the rename landed (2026-09-30, FLEX-WP-0020).
## Related
- `pep-stance.yaml` — published fail-closed map
- `pip-claims.yaml` — input-class freshness
- `flex-auth/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md`
- `access-engine/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md`
- `key-cape/workplans/KEY-WP-0005-iam-profile-core-claims.md`
- `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`