TraconPolicies

Namespace Tracon · Assembly Tracon.AspNetCore.dll

Role-based authorization policy names that Tracon defines.

public static class TraconPolicies

Inheritance

object ← TraconPolicies

Inherited Members

object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Tracon stores no user and no role. Roles come from the consumer identity system; Tracon defines only the policy name, and the consumer binds those names to its own claims:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(TraconPolicies.Reader,   p => p.RequireRole("tracon-reader",
                                                                     "tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Operator, p => p.RequireRole("tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Admin,    p => p.RequireRole("tracon-admin"));
});

When a policy is not registered, that endpoint falls back to its earlier behavior (only the existing three-layer protection: loopback, bearer token, general authorization policy). Otherwise this role model would break the setup of everyone who updates, with a 403. A production setup can turn a missing policy into a startup failure with TraconEndpointOptions.RequireRolePolicies.

Fields

Admin

Everything: writing an agent definition, adding an MCP server, deleting an approval rule, tenant management.

public const string Admin = "Tracon.Admin"

Field Value

string

Operator

Reader plus starting a run, granting an approval, deleting a session.

public const string Operator = "Tracon.Operator"

Field Value

string

PlatformAdmin

Acting on a tenant other than the caller’s own: another tenant’s model provider bindings and egress policy, and the tenant records of the installation.

public const string PlatformAdmin = "Tracon.PlatformAdmin"

Field Value

string

Remarks

Unlike the three role policies, a missing registration denies. An unregistered role policy falls back to the three-layer protection so that an upgrade does not break a setup; a claims-authenticated caller of tenant A reaching tenant B’s secrets is not a fallback worth keeping. Only a claims principal needs this policy: an API key proves platform authority with the ApiKeyScope.PlatformAdmin scope, and the static TraconEndpointOptions.AuthToken identifies the installation itself.

The caller’s own tenant never needs it: that stays with TraconPolicies.Admin.

Reader

Read access: agents, runs, sessions, traces, statistics.

public const string Reader = "Tracon.Reader"

Field Value

string