# tenant-engine — PEP unreachable-engine stance map
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2 §5
# Named from: layer.yaml (pep_stance)
# Validate:   tests/test_layer_conformance.py
#
# tenant-engine's protected side effect is a mutation of tenant-as-an-entity
# facts (create, grant, revoke, plan, lifecycle, grouping, guardrail).
# This is not ops-warden's per-zone fail-open map. A PIP that cannot ask
# the PDP does not guess; it refuses.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: tenant-engine
pep_shape: true
declared_by: decisions/decisions.md#TEN-DEC-2026-001

protected_action: "mutation of tenant-as-an-entity facts"
decision_engine: access-engine
scope: engine-reachability

# Total by construction. No implicit default — an unlisted value is a
# config error, not a permissive fallback. Every scope fails closed.
stance:
  unset: fail_closed          # TENANT_ENGINE_FLEX_AUTH_URL is not set
  unreachable: fail_closed    # transport, timeout, non-2xx, malformed body
  non_allow: fail_closed      # a decision was rendered, effect was not allow
  unknown: fail_closed

on_apply:
  recorded_fields:
    - authorization_source    # decision | stance
    - authorization_decision_id
    - authorization_request_digest
    - authorization_effect
    - authorization_stance
    - authorization_reason
    - action
    - tenant_id
    - actor
    - allowed
  written_to:
    - "authz_records (every authorize attempt)"
    - "events.payload (successful mutations only)"
  never_recorded: "tokens, secrets, request bodies beyond the check digest"

# §6.4 obligation 2 — the verdict is never cached. Every write re-checks.
verdict_caching: none