computer-playbook/roles/web-app-hermes/meta/rbac.yml at fix/dev-python/python-upper-bound - computer-playbook - Infinito.Nexus Code Hub

kevinveenbirkenbach/computer-playbook

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 19:01:54 +00:00

Files

T

kevinveenbirkenbach 67feed6332 feat(rbac): declare the mcp role on every agent that carries clients

An mcp grant lets its holder drive clients that reach admitted providers
with the credentials the deployment issued, not the caller's own, so the
role is declared per application and never spans them.

The unit test pins that boundary directly: a scoped grant reaches only
the named application, an unscoped one reaches nothing, and an ordinary
role still spans everything. The Keycloak realm builder, the LDAP entry
builder and the Open WebUI reconciler all resolve membership through the
one module this covers.

2026-08-09 23:53:41 +02:00

5 lines

179 B

YAML

Raw Permalink Blame History

 ---
 roles:
   mcp:
     description: May drive this agent's MCP clients, which reach every admitted provider with the credentials the deployment issued rather than the caller's own