Repository navigation
Feat/policy azure backend - #97
Merged
Merged
Conversation
IGA_GRAPH_PROJECTION, IGA_POLICY, IGA_POLICY_R1B, IGA_POLICY_R2, IGA_POLICY_R3, IGA_POLICY_OWNERSHIP and IGA_LEGACY_AGENT_POLICY are gone; setting them now does nothing. Each part is always on and serves once its own schema verifies (graph 036, policy 047-059, R1b 060, R2 061, R3 062, access policies 137-138), failing closed with the reason in /capabilities until then. Schema verification stays: it is a safety check, not a switch. - main installs on gates; ownership is fixed to admin; the two legacy agent-policy workers always start and their compat routes always exist. - R2, access-policy and R3 routes are always mounted (503 until available); /capabilities always reports actions, temporary_grants, session_revoke, time_bound, lambda_split_direct, runtime_controls, brokered_sessions and access_policies; R2 jobs always register; new enforcement bindings get template v2; the full event vocabulary is always served. - Kubernetes ingest reads the process graph gate instead of building one from the environment. - Specs (graph 2.8 and 7.5, policy 4.3 and every mention), the disposition plan, the scheduled-scans spec, the e2e test doc, two flow docs and CLAUDE.md updated; decision logged 2026-10-21. - Tests: env-parsing tests removed; the capabilities contract lists the always-present fields; enforcement tests expect v2; the audit walker lists the newly mounted R2/access/R3 routes, which it still does not walk. Unchanged: IGA_DISCOVERY_INGEST_AUTH, secrets, tuning values and the AUTHSEC_DISABLE_* worker kill switches.
…aph read SPEC-access-policies.md: the AWS and Azure access-policy flow, screens, the backend changes Azure parity needs, and the Azure demo. P2-DECISIONS D-114 (proposed): Azure on /graph, /graph/expand and /graph/path, with the role assignment as the middle node and leaf scope nodes for subscriptions, resource groups and the directory.
The traversal routes read the Azure projection as they read Kubernetes': identity -> role assignment (one per iga_access_edges row, never the shared role definition) -> resource, or a leaf scope node for an assignment that names no resource (subscription, resource group, directory, tenant root). Reverse from a resource returns the assignments on it and their holders. member_of, can_assume and executes_as come from iga_relationship. Meta: unrevisioned, effective_access_not_evaluated and azure_conditions_not_evaluated; azure_scope_access_not_drawn on a resource reached from a broader scope. AWS and Kubernetes responses are unchanged (contract test). Every query runs in the level's RLS transaction and matches workspace_id on both sides of each join. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- resource.provider/name/kind, roles[].kind, deployments[].target_ref (the ARM scope on Azure); the list takes ?provider=aws|azure. - readiness adds azure_subscriptions: AuthSec's app can write and delete role assignments there (the preview's live check, cached a minute). - status reasons name the cloud (removing from Azure / restoring access in Azure); a new status 'ending' holds until every deployment has left the cloud, so End no longer reads 'ended' before access is restored. - migration 144 is verified on its own: without it Azure preview and create return 503 with the reason and AWS policies keep working. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Changes
Testing
go test -short ./tests/unit/)go vet ./...cleanrun-integrationto this PR to trigger integration tests in CI (requires a live DB)Checklist