symfonic.services.switching.authz

authz

SCP-AUTH / SCP-BG — who may mutate switch state, and how break-glass works.

Roles are a closed set with an explicit action table and no implication edges. A hierarchy ("release-owner can do everything an operator can") is exactly how a break-glass credential ends up able to advance a retirement, so there isn't one: every role's actions are listed, and nothing is inherited.

Actor dataclass

Actor(identity: str, role: Role, bundles: frozenset[str] = frozenset(), kind: str = 'human')

SCP-AUTH-1 — an authenticated human or named workflow identity.

kind='service' exists so it can be refused: a shared service account is the exact anti-pattern the clause names, and a vocabulary that could not express it would turn a stated rule into an unenforceable one.

BreakGlassCredential dataclass

BreakGlassCredential(credential_id: str, bundle_id: str, identity: str = 'bg:on-call')

SCP-BG-1/3 — pre-provisioned, sealed, single-use, bundle-scoped.

SwitchAuthorizer

SwitchAuthorizer(*, available: bool = True)

Evaluates SCP-AUTH. available=False models an identity-provider outage.

Source code in src/symfonic/services/switching/authz.py

def __init__(self, *, available: bool = True) -> None:
    self._available = available