The financial-services and healthcare Cedar bundles open with a catch-all permit (principal, action, resource); and rely on forbid rules for all constraints. The READMEs describe workflow-scoped access, but with a catch-all permit the workflow restriction is decorative: any workflow (or no workflow) can call any catalog tool unless a forbid fires.
Replace the catch-all with explicit per-action permits gated on context.workflow_id (the pattern the globex-financial tenant bundle already uses), keep the annotated forbid rules, and re-verify both demo paths end-to-end. Recapture trace-output reference files afterwards.
Launch-blocking for the demo story: the runtime enforces faithfully, so the policy must actually encode what the docs claim.
Generated with Claude Code
The financial-services and healthcare Cedar bundles open with a catch-all
permit (principal, action, resource);and rely on forbid rules for all constraints. The READMEs describe workflow-scoped access, but with a catch-all permit the workflow restriction is decorative: any workflow (or no workflow) can call any catalog tool unless a forbid fires.Replace the catch-all with explicit per-action permits gated on
context.workflow_id(the pattern the globex-financial tenant bundle already uses), keep the annotated forbid rules, and re-verify both demo paths end-to-end. Recapture trace-output reference files afterwards.Launch-blocking for the demo story: the runtime enforces faithfully, so the policy must actually encode what the docs claim.
Generated with Claude Code