230 lines
8.5 KiB
JSON
230 lines
8.5 KiB
JSON
|
{
|
||
|
|
"id": "decision:345172e88988026a",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "exact_task_execution_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "exact_task_execution_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:synthetic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform"
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform"
|
||
|
|
},
|
||
|
|
"action": "execute-ccr",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:synthetic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"approval": {
|
||
|
|
"approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
|
||
|
|
"binding": {
|
||
|
|
"action": "execute-ccr",
|
||
|
|
"actor": "secrets-engine",
|
||
|
|
"digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||
|
|
"human_control": true,
|
||
|
|
"pdp_digest": "sha256:1314ecedf5f8607a41ac4b5f951a4f47460ff4a6fecff70b057698688a5e71e4",
|
||
|
|
"pdp_path": true,
|
||
|
|
"principal": "secrets-engine",
|
||
|
|
"purpose": "actual Python App source-only synthetic proof",
|
||
|
|
"target": {
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod"
|
||
|
|
},
|
||
|
|
"id": "catalog:synthetic",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"type": "secret-catalog-lane"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"consumed": false,
|
||
|
|
"freshness": {
|
||
|
|
"not_after": "2026-10-16T14:39:10+00:00",
|
||
|
|
"observed_at": "2026-10-16T14:37:10+00:00",
|
||
|
|
"ttl_seconds": 120
|
||
|
|
},
|
||
|
|
"issuer": "approval-engine",
|
||
|
|
"kind": "approval-claim",
|
||
|
|
"reason_code": "ok",
|
||
|
|
"schema_version": "0.1",
|
||
|
|
"state": "valid",
|
||
|
|
"valid_now": true,
|
||
|
|
"validity": {
|
||
|
|
"expires_at": "2026-10-16T14:40:10.168539+00:00",
|
||
|
|
"not_before": "2026-10-16T14:36:10.168539+00:00"
|
||
|
|
},
|
||
|
|
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||
|
|
},
|
||
|
|
"catalog_target": {
|
||
|
|
"lane": "synthetic",
|
||
|
|
"stage": "prod"
|
||
|
|
},
|
||
|
|
"execution_contract": {
|
||
|
|
"backend_budget": {
|
||
|
|
"ttl_seconds": 30,
|
||
|
|
"uses": 12
|
||
|
|
},
|
||
|
|
"backend_origin": "http://127.0.0.1:18200",
|
||
|
|
"catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc",
|
||
|
|
"ccr_id": "CCR-2099-0001",
|
||
|
|
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||
|
|
"cluster_uid": "synthetic-not-native",
|
||
|
|
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||
|
|
"execution_actor": "service:secrets-engine",
|
||
|
|
"execution_grant_ccr_id": "CCR-2099-0002",
|
||
|
|
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||
|
|
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||
|
|
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||
|
|
"operation": "metadata-apply-ccr",
|
||
|
|
"operation_deadline": "2026-10-16T14:38:10+00:00",
|
||
|
|
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||
|
|
"operations": [
|
||
|
|
{
|
||
|
|
"method": "GET",
|
||
|
|
"path": "sys/policies/acl/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"method": "PUT",
|
||
|
|
"path": "sys/policies/acl/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"method": "GET",
|
||
|
|
"path": "sys/policies/acl/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"method": "GET",
|
||
|
|
"path": "auth/synthetic/role/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"method": "PUT",
|
||
|
|
"path": "auth/synthetic/role/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"method": "GET",
|
||
|
|
"path": "auth/synthetic/role/synthetic",
|
||
|
|
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"source_bundle": {
|
||
|
|
"engine_dispatcher": {
|
||
|
|
"path": "/synthetic/engine_dispatcher.py",
|
||
|
|
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
"platform_mediator": {
|
||
|
|
"path": "/synthetic/platform_mediator.py",
|
||
|
|
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
"policy_auth": {
|
||
|
|
"path": "/synthetic/policy_auth.py",
|
||
|
|
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
},
|
||
|
|
"typed_ccr": {
|
||
|
|
"path": "/synthetic/typed_ccr.py",
|
||
|
|
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"human_control": true,
|
||
|
|
"purpose": "actual Python App source-only synthetic proof",
|
||
|
|
"service_actor_binding": {
|
||
|
|
"subject_id": "secrets-engine",
|
||
|
|
"subject_type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||
|
|
"version": "proposed-service-task-caller/v1"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:5de47c87ba31a96c51cffd75e3a1236a830745c9bf2087d5a44b640b40c11540",
|
||
|
|
"approval_binding_digest": "sha256:1314ecedf5f8607a41ac4b5f951a4f47460ff4a6fecff70b057698688a5e71e4",
|
||
|
|
"submitted_request_digest": "sha256:5de47c87ba31a96c51cffd75e3a1236a830745c9bf2087d5a44b640b40c11540"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "59.254796424s",
|
||
|
|
"not_before": "2026-10-16T14:37:10.745203576Z",
|
||
|
|
"expires_at": "2026-10-16T14:38:10Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "execute-ccr",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||
|
|
"policy_status": "proposed",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": false
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||
|
|
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:1000c59c0b5765bc2de159a42c0cfa861ce840547e87edb5cadd8de20f177a31"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-10-16T14:37:10Z",
|
||
|
|
"approval_observation": {
|
||
|
|
"source_id": "synthetic-actual-approval-app",
|
||
|
|
"source_revision": "actual-owner-python-source-fixture",
|
||
|
|
"configuration_digest": "sha256:b646af61ef4d13a89c82a267d93b38eab6bcfc3ba0314550577dd883bdd221a2",
|
||
|
|
"claim_digest": "sha256:dfeec32f189bc8ed5500bc1f7a53758183cd889ee9472dc8ee5d506dd5c67393",
|
||
|
|
"native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||
|
|
"observed_at": "2026-10-16T14:37:10Z",
|
||
|
|
"not_after": "2026-10-16T14:39:10Z",
|
||
|
|
"validated_at": "2026-10-16T14:37:10.733320979Z"
|
||
|
|
},
|
||
|
|
"caller": {
|
||
|
|
"mode": "enforce",
|
||
|
|
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||
|
|
"audience": "flex-auth",
|
||
|
|
"not_after": "2026-10-16T14:39:10Z"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"signature": {
|
||
|
|
"mode": "signed",
|
||
|
|
"alg": "ed25519",
|
||
|
|
"kid": "synthetic-v2",
|
||
|
|
"value": "XP7oAYq5QDFThW8NkQunirFEcCmOwqkxeJiaQWbJGdi--x2XEVOtJH_mZmAQGeTXmcZGWS6WNtNVltgD2NxVDA"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|