Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions p1-task-manager/docs/tutorials.md
Original file line number Diff line number Diff line change
Expand Up @@ -182,8 +182,8 @@ with creation and extending the rules to the other task operations.
Every operation requires the user's current tenant to match the resource tenant.
For existing tasks, "related" means the user owns the task or is its assignee.

| Capability | Action | Resource | Additional conditions |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------- |
| Capability | Action | Resource | Additional conditions |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------- |
| `task.view` | [`View`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L8 "server-view-related-task") | `Task` | Related user |
| `task.create` | [`Create`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L33 "server-owner-create-task") | `Tenant` | Owner role, assurance at least 2 |
| `task.edit` | [`Edit`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p1-task-manager/policy-store/policies/server-access.cedar#L58 "server-edit-related-task") | `Task` | Related user |
Expand Down
4 changes: 2 additions & 2 deletions p2-tenantrag/docs/tutorials.md
Original file line number Diff line number Diff line change
Expand Up @@ -310,8 +310,8 @@ handled as failures.

### Choose an action and resource for each check

| Capability | Identity | Action | Resource | Context | Effect waiting for ALLOW |
| ------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ---------------------------------------------- | -------------------------------------- |
| Capability | Identity | Action | Resource | Context | Effect waiting for ALLOW |
| ------------------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ---------------------------------------------- | -------------------------------------- |
| `corpus.search` | Caller access token | [`SearchCorpus`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p2-tenantrag/policy-store/policies/server-access.cedar#L2 "server-search-tenant-corpus") | Resolved corpus | Current user, selected corpus, server boundary | Query embedding and vector search |
| `document.retrieve` | Same token | [`RetrieveDocument`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p2-tenantrag/policy-store/policies/server-access.cedar#L25 "server-retrieve-authorized-document") | Each unique candidate document | Same trusted context | Load text for generation and citations |

Expand Down
4 changes: 2 additions & 2 deletions p3-mcp-capability-governance/docs/tutorials.md
Original file line number Diff line number Diff line change
Expand Up @@ -163,8 +163,8 @@ operations each role may use and when an incident assignment is required.
Each action links to its policy. Requests use the signed caller token; roles and
assignments come from the server.

| Capability | Identity | Action | Resource | Trusted context | Protected effect |
| -------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------- | ------------------------------------------- |
| Capability | Identity | Action | Resource | Trusted context | Protected effect |
| -------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------- | ------------------------------------------- |
| Discover | Signed caller token | [`Discover`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L16 "operations-surface") | `Service::"incident-assistant"` | Current caller subject and role | Make MCP operations available to the caller |
| Search | Same token | [`Search`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L16 "operations-surface") | Same service | Same caller | Begin incident search |
| Read result | Same token | [`Read`](https://github.com/GluuFederation/cedarling-tutorials/blob/main/p3-mcp-capability-governance/policy-store/policies/incident-operations.cedar#L26 "incident-assignment") | Each candidate `Incident` | Same caller; assignment on resource | Return a matching incident summary |
Expand Down
Loading