tegwick
672cf4da6e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client scan). Writes persist a decision record or the published fail-closed stance, live-lookup freshness is published, events_for is tenant-scoped, and mutation evidence drains to audit-core from a local outbox without blocking the mutation. Sender registration is requested as AUDIT-IN-0002. Boundary-contract amendment is requested as NET-IN-0002. Assistant: grok Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
50 lines
1.8 KiB
YAML
50 lines
1.8 KiB
YAML
# tenant-engine — PEP unreachable-engine stance map
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2 §5
|
|
# Named from: layer.yaml (pep_stance)
|
|
# Validate: tests/test_layer_conformance.py
|
|
#
|
|
# tenant-engine's protected side effect is a mutation of tenant-as-an-entity
|
|
# facts (create, grant, revoke, plan, lifecycle, grouping, guardrail).
|
|
# This is not ops-warden's per-zone fail-open map. A PIP that cannot ask
|
|
# the PDP does not guess; it refuses.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: tenant-engine
|
|
pep_shape: true
|
|
declared_by: decisions/decisions.md#TEN-DEC-2026-001
|
|
|
|
protected_action: "mutation of tenant-as-an-entity facts"
|
|
decision_engine: access-engine
|
|
scope: engine-reachability
|
|
|
|
# Total by construction. No implicit default — an unlisted value is a
|
|
# config error, not a permissive fallback. Every scope fails closed.
|
|
stance:
|
|
unset: fail_closed # TENANT_ENGINE_FLEX_AUTH_URL is not set
|
|
unreachable: fail_closed # transport, timeout, non-2xx, malformed body
|
|
non_allow: fail_closed # a decision was rendered, effect was not allow
|
|
unknown: fail_closed
|
|
|
|
on_apply:
|
|
recorded_fields:
|
|
- authorization_source # decision | stance
|
|
- authorization_decision_id
|
|
- authorization_request_digest
|
|
- authorization_effect
|
|
- authorization_stance
|
|
- authorization_reason
|
|
- action
|
|
- tenant_id
|
|
- actor
|
|
- allowed
|
|
written_to:
|
|
- "authz_records (every authorize attempt)"
|
|
- "events.payload (successful mutations only)"
|
|
never_recorded: "tokens, secrets, request bodies beyond the check digest"
|
|
|
|
# §6.4 obligation 2 — the verdict is never cached. Every write re-checks.
|
|
verdict_caching: none
|