Register generic resource permissions with exact filters #58

Open

opened 2026-10-04 17:44:27 +00:00 by kayg · 0 comments

kayg commented 2026-10-04 17:44:27 +00:00

Owner

Copy link

Problem and evidence

crates/proto/src/permissions.rs:11-72 defines a closed Scope enum; workload scopes are container-named. The provider contract describes exact instance/resource restrictions, but the generic resource/action policy has no complete runtime registration representation. Provider descriptors must not create authorization by themselves.

Recommendation

Add validated, explicitly registered resource-kind and action permissions with exact instance/resource filters. Require reviewed policy registration for each new action. Keep capability metadata limited to narrowing what policy allows.

Payoff and estimate

Lets a new resource use the shared plan, grant and audit path without container-shaped scopes, while preserving least privilege. Estimate: 2–4 engineering days including authorization tests and a feature-to-policy matrix.

Priority: Next milestone (PLAN step 5).

2026-10-04 owner decisions: Matches the owner’s action × resource selectors and decision to keep signed RPC, scopes, plans and audit as product properties. Related: #49.

Report: arch-review report
Source: arch-review 2026-10-04

## Problem and evidence `crates/proto/src/permissions.rs:11-72` defines a closed `Scope` enum; workload scopes are container-named. The provider contract describes exact instance/resource restrictions, but the generic resource/action policy has no complete runtime registration representation. Provider descriptors must not create authorization by themselves. ## Recommendation Add validated, explicitly registered resource-kind and action permissions with exact instance/resource filters. Require reviewed policy registration for each new action. Keep capability metadata limited to narrowing what policy allows. ## Payoff and estimate Lets a new resource use the shared plan, grant and audit path without container-shaped scopes, while preserving least privilege. Estimate: 2–4 engineering days including authorization tests and a feature-to-policy matrix. **Priority:** Next milestone (PLAN step 5). **2026-10-04 owner decisions:** Matches the owner’s action × resource selectors and decision to keep signed RPC, scopes, plans and audit as product properties. Related: #49. **Report:** [arch-review report](/mnt/hdd/infraternal/jobs/arch-review/report.md) **Source: arch-review 2026-10-04**

Commenting is not possible because the repository is archived.

No Branch/Tag specified

Branches Tags

main

dev

perf-gates

provider-docker-podman

fix-networkidle

fix-apierror-panics

fix-revoke-panic

wal-race

fix-private-storage

provider-runtime

plugin-design

server-channels

scope-v01

deploy-git-fix

sec-hardening

gates-tiering

sidebar-sync

multi-tab

cli-eof

podman-flake

ssh-reattach

agent-tunnel

process-boundary

shadcn

stream-params

cli-ssh

ssh-product

container-live

flaky-tests

s1-e2e

ssh-test-isolation

cli-stream

research-lxc

container-live-agent

ui-apis

grant-shrink

deploy-o2

ui-redesign

migration-fix

cli

stream

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal-v0#58

No description provided.