f5da9815b2
OCCIAMAdapter (name='occ-native') with deny-by-default authorization:
bindings (direct + via groups) grant exact actions at containing scopes
(installation ⊇ namespace ⊇ exact resource); Restrictions
('action:Kind[:name]') narrow but never grant, raising RestrictionError.
IAMStore keeps Principal / ServicePrincipal / WorkloadIdentity / Group /
Role / AccessBinding / Restriction in their own SQLite tables (WAL,
RLock) and enforces namespace confinement of bindings at creation.
resolve_principal() resolves only — admission can never create identities.
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| audit.py | ||
| contracts.py | ||
| errors.py | ||
| iam.py | ||
| resources.py | ||
| store.py | ||