87 lines
2.9 KiB
Markdown
87 lines
2.9 KiB
Markdown
|
# ProofedMesh Policies (OPA / Rego)
|
||
|
|
|
||
|
|
Rego-Policies für die drei in [`docs/architecture/v1.1.md`](../docs/architecture/v1.1.md) Abschnitt 6 definierten Policy-Klassen. Alle Policies nutzen **Rego v1** (`import rego.v1`).
|
||
|
|
|
||
|
|
## Policy-Klassen
|
||
|
|
|
||
|
|
| Klasse | Package-Präfix | Fragt der |
|
||
|
|
| ----------------- | ------------------------------------ | ------------------------------ |
|
||
|
|
| Transformationen | `proofedmesh.transformations.<domain>` | Signing Service |
|
||
|
|
| Senken | `proofedmesh.sinks.<sink_id_slug>` | Verification Service / Adapter |
|
||
|
|
| Datenquellen | `proofedmesh.data_sources.<ds_id_slug>` | Session Scope Token Service |
|
||
|
|
|
||
|
|
Default in jedem Package ist `allow := false` — explizites Zulassen ist erforderlich (deny-by-default).
|
||
|
|
|
||
|
|
## Dateistruktur
|
||
|
|
|
||
|
|
```
|
||
|
|
policies/
|
||
|
|
transformations/
|
||
|
|
expense.rego
|
||
|
|
expense_test.rego
|
||
|
|
sinks/
|
||
|
|
expense_db_app.rego
|
||
|
|
expense_db_app_test.rego
|
||
|
|
data_sources/
|
||
|
|
expense_db_app.rego
|
||
|
|
expense_db_app_test.rego
|
||
|
|
```
|
||
|
|
|
||
|
|
## Input-Verträge
|
||
|
|
|
||
|
|
### Transformationen
|
||
|
|
|
||
|
|
```json
|
||
|
|
{
|
||
|
|
"agent_id": "agent-sink-mapping",
|
||
|
|
"operation": "expense.map_to_sink",
|
||
|
|
"input_schema": { "name": "expense.canonical", "version": "1.0.0" },
|
||
|
|
"output_schema": { "name": "sink.db.expense", "version": "1.0.0" },
|
||
|
|
"sink_target": "sink:expense-db-app",
|
||
|
|
"approval": { "allowed_transformations": [...], "allowed_sinks": [...] },
|
||
|
|
"input_payload": { ... canonical fields ... },
|
||
|
|
"output_payload": { ... sink fields ... }
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
### Senken
|
||
|
|
|
||
|
|
```json
|
||
|
|
{
|
||
|
|
"agent_id": "agent-sink-posting",
|
||
|
|
"sink_id": "sink:expense-db-app",
|
||
|
|
"action": "expense.post",
|
||
|
|
"payload": { ... sink.db.expense ... },
|
||
|
|
"approval": { "allowed_sinks": [...] }
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
### Datenquellen (für Session Scope Token Service)
|
||
|
|
|
||
|
|
```json
|
||
|
|
{
|
||
|
|
"agent_id": "agent-travel",
|
||
|
|
"user_sub": "user-12345",
|
||
|
|
"session_id": "SES-...",
|
||
|
|
"data_source": "ds:expense-db-app",
|
||
|
|
"resource": "project_assignments",
|
||
|
|
"filters": { "employee_id": "EMP-12345" },
|
||
|
|
"operation": "read"
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
Zusätzliche Daten (nicht `input`, sondern über `data.*` bereitgestellt): `data.employee_mapping.by_sub` (user_sub → employee_id), `data.agent_registry.by_id` (Agent-Metadaten), `data.sinks.by_id`, `data.data_sources.by_id`. Trust-API lädt diese bei jedem Policy-Call aus Postgres und übergibt sie via OPA Partial-Evaluation oder bei Bedarf als `input.data`.
|
||
|
|
|
||
|
|
## Lokal testen
|
||
|
|
|
||
|
|
```bash
|
||
|
|
opa test policies/ -v
|
||
|
|
opa fmt --list --diff policies/ # formatting check
|
||
|
|
```
|
||
|
|
|
||
|
|
Beides läuft auch in CI (siehe `.forgejo/workflows/validate.yml`).
|
||
|
|
|
||
|
|
## Policy-Versionierung
|
||
|
|
|
||
|
|
Jede Policy-Datei bekommt bei Breaking Changes eine neue Hauptversion. Historische Versionen bleiben parallel, solange Attestierungen mit `policy_version` darauf verweisen (Retention 1 Jahr). Rego-Bundles für Deployment werden aus dem jeweiligen Branch gebaut; der SHA-256 des Bundles landet in jeder Decision als `policy_version` (siehe ADR-0002, Abschnitt „Token-Format").
|