the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r1/access-engine-source/examples/forgejo-application-access/policy.md

id	name	namespace	version	status	package	allow_ttl	actions	owner	caring
forgejo.application-access	Forgejo authenticated application access	forgejo:application	v1	draft	flexauth.forgejo.application	10s	application.access	railiance-apps	profile enforce caring-0.4.0-rc2 false

This source policy enforces the original three-group any-of in the sole PDP. The registry identifies the application tenant and admitted issuer. This policy requires aal2 assurance. The PEP independently verifies the ID token and supplies fresh UserInfo groups; the authenticated workload caller may represent only the Forgejo system. A decision authorizes one login callback, never a later HTTP/Git/SSH/API operation. The accompanying registry is synthetic test data, not an estate admission.

import rego.v1

default decision := {"effect": "deny", "reason": "application_access_refused"}

original_groups := {"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}

decision := {"effect": "allow", "reason": "current_authenticated_application_access"} if {
  input.action == "application.access"
  object.get(input, "purpose", "") == ""
  input.resource.id == "application:forgejo"
  input.resource.type == "application"
  input.resource.system == "forgejo"
  input.tenant == input.resource.tenant
  input.tenant == input.resource.attributes.tenant
  input.subject.tenant == input.tenant
  input.context.identity_tenant == input.tenant
  input.subject.id == input.context.identity_subject
  input.subject.type == input.context.identity_principal_type
  input.subject.type == "human"
  input.subject.attributes.issuer == input.context.identity_issuer
  input.context.identity_issuer == input.resource.attributes.identity_issuer
  input.subject.attributes.assurance == input.context.identity_assurance
  input.context.identity_assurance == "aal2"
  count(input.context.required_groups_any_of) == 3
  {g | g := input.context.required_groups_any_of[_]} == original_groups
  input.subject.attributes.current_userinfo_groups == input.context.current_userinfo_groups
  some group in input.context.current_userinfo_groups
  group in original_groups
  is_string(input.context.decisionpep_request_nonce)
  count(input.context.decisionpep_request_nonce) == 64
}