diff --git a/p1-task-manager/docs/tutorials.md b/p1-task-manager/docs/tutorials.md index bf82871..d5c921d 100644 --- a/p1-task-manager/docs/tutorials.md +++ b/p1-task-manager/docs/tutorials.md @@ -182,8 +182,8 @@ with creation and extending the rules to the other task operations. Every operation requires the user's current tenant to match the resource tenant. For existing tasks, "related" means the user owns the task or is its assignee. -| Capability | Action | Resource | Additional conditions | -| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------- | +| Capability | Action | Resource | Additional conditions | +| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------- | | `task.view` | [`View`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L8 "server-view-related-task") | `Task` | Related user | | `task.create` | [`Create`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L33 "server-owner-create-task") | `Tenant` | Owner role, assurance at least 2 | | `task.edit` | [`Edit`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L58 "server-edit-related-task") | `Task` | Related user | diff --git a/p2-tenantrag/docs/tutorials.md b/p2-tenantrag/docs/tutorials.md index 020c8c1..b46314f 100644 --- a/p2-tenantrag/docs/tutorials.md +++ b/p2-tenantrag/docs/tutorials.md @@ -310,8 +310,8 @@ handled as failures. ### Choose an action and resource for each check -| Capability | Identity | Action | Resource | Context | Effect waiting for ALLOW | -| ------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ---------------------------------------------- | -------------------------------------- | +| Capability | Identity | Action | Resource | Context | Effect waiting for ALLOW | +| ------------------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ---------------------------------------------- | -------------------------------------- | | `corpus.search` | Caller access token | [`SearchCorpus`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p2-tenantrag/policy-store/policies/server-access.cedar#L2 "server-search-tenant-corpus") | Resolved corpus | Current user, selected corpus, server boundary | Query embedding and vector search | | `document.retrieve` | Same token | [`RetrieveDocument`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p2-tenantrag/policy-store/policies/server-access.cedar#L25 "server-retrieve-authorized-document") | Each unique candidate document | Same trusted context | Load text for generation and citations | diff --git a/p3-mcp-capability-governance/docs/tutorials.md b/p3-mcp-capability-governance/docs/tutorials.md index 72865d2..93d2e94 100644 --- a/p3-mcp-capability-governance/docs/tutorials.md +++ b/p3-mcp-capability-governance/docs/tutorials.md @@ -163,8 +163,8 @@ operations each role may use and when an incident assignment is required. Each action links to its policy. Requests use the signed caller token; roles and assignments come from the server. -| Capability | Identity | Action | Resource | Trusted context | Protected effect | -| -------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------- | ------------------------------------------- | +| Capability | Identity | Action | Resource | Trusted context | Protected effect | +| -------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------- | ------------------------------------------- | | Discover | Signed caller token | [`Discover`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L16 "operations-surface") | `Service::"incident-assistant"` | Current caller subject and role | Make MCP operations available to the caller | | Search | Same token | [`Search`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L16 "operations-surface") | Same service | Same caller | Begin incident search | | Read result | Same token | [`Read`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L26 "incident-assignment") | Each candidate `Incident` | Same caller; assignment on resource | Return a matching incident summary |