Feat: Policy Model ALLOW/DENY (positive + negative) rules - #808

Merged

anatolykoyfman merged 98 commits into

mainfrom

policy-model-allow-deny-clean

Aug 26, 2026

Commits on Aug 4, 2026

Commits on Aug 5, 2026

Merge remote-tracking branch 'origin/main' into aiac-phase2
oblinder
committed
adeadb0
Merge remote-tracking branch 'origin/main' into aiac-policy-guardrails
oblinder
committed
bfe5b31
policy-guardrails hygiene
anatolykoyfman
committed
bd7e398
Docs: Rename Policy Store to Policy Model Store in specs
oblinder
committed
2213cdf
docs: De-hardcode aiac CLAUDE.md structure in favor of live discovery
oblinder
committed
a8e4f35
Refactor: Rename Policy Store to Policy Model Store
oblinder
committed
93adfdd
docs: Align Policy Model Store boxes and reroute PCE→PDP arrow in PRD diagram
oblinder
committed
9e7568d
refactor: Rename kagenti to rossoctl across AIAC (realm, operator contract, brand, repo paths)
oblinder
committed
1c0716f
Test: Normalize kagenti fixture strings to rossoctl in test_models.py
oblinder
committed
1ab2892
Merge branch 'aiac-phase2' into aiac-policy-store-rename
oblinder
committed
f02c772
Docs: Rename remaining Policy Store references to Policy Model Store
oblinder
committed
f30b8ad
Merge branch 'aiac-policy-store-rename' into aiac-phase2
oblinder
committed
5d09e08
Fix: Own copied files as non-root aiac user in Dockerfiles
oblinder
committed
39e10da
Feat: Add /health endpoint to AIAC Agent Controller
oblinder
committed
d3cda22

Commits on Aug 6, 2026

merge adjustments
anatolykoyfman
committed
90e7598

Commits on Aug 9, 2026

Commits on Aug 11, 2026

Commits on Aug 12, 2026

Commits on Aug 13, 2026

Chore: Address PR review nits (source_ok comment, empty client_id test)
oblinder
committed
37a4d4a
initial support for event broker

omerboehm
authored and
oblinder
committed
5881d60
class files

omerboehm
authored and
oblinder
committed
4d70ec3
Fix: Bump Keycloak SPI deps to 26.6.3 to clear dependency-review advisories
oblinder
committed
69049f7
Fix: Drop unused keycloak-services dep to clear dependency-review advisories
oblinder
committed
371ac72
Fix: Floor cryptography at 50.0.0 to clear dependency-review advisory
oblinder
committed
f593b43
Chore: Address PR review nits (pin nats image, untrack keycloak-spi/target)
oblinder
committed
21cf829
Feat: AIAC OPA plugin integration + live enforcement (phase 2, PR 1) (#752)

oblinder
and
anatolykoyfman
authored
3a1dc59
Merge branch 'main' into aiac-phase2-opa-event-broker
omerboehm
authored
a8b918c
docs: Fold ALLOW/DENY policy-rule model into AIAC specs

oblinder
authored and
anatolykoyfman
committed
79158a1
docs: Fold PRB deny-extraction into policy-rules-builder sub-PRD
anatolykoyfman
committed
502c8ba
feat: Add RuleEffect + split rule/target fields to policy model (#117)

oblinder
authored and
anatolykoyfman
committed
2b1d40e
Docs: Add Policy Model Store state-reset runbook (ALLOW/DENY, no back-compat) (#121)

oblinder
authored and
anatolykoyfman
committed
f346258
Feat: PCE routes and derives policy rules by effect (ALLOW/DENY) (#118)

oblinder
authored and
anatolykoyfman
committed
e303e7e
Fix: Update Policy Model Store + client to split ALLOW/DENY rule fields (#120)

oblinder
authored and
anatolykoyfman
committed
aa7d614
Test: Keep PRB green and allow-only under the ALLOW/DENY model (#122)

oblinder
authored and
anatolykoyfman
committed
1c85abb
Test: Keep Build+Rebuild policy-update sub-agents green under ALLOW/DENY model (#127)

oblinder
authored and
anatolykoyfman
committed
cbe05ae
Test: Realign aiac.pdp.library tests to ALLOW/DENY model (#128)

oblinder
authored and
anatolykoyfman
committed
bd07fce
Feat: PDP writer emits split ALLOW/DENY gates with deny-overrides (#119)

oblinder
authored and
anatolykoyfman
committed
ebb7156
feat: Teach PRB to extract DENY rules from policy text
anatolykoyfman
committed
b94afc6
Test: Realign policy-pipeline integration driver to ALLOW/DENY identifiers (#125)
anatolykoyfman
committed
1ddfff3
Test: Add source-dimension deny-overrides coverage to OPA writer tests (#126)
anatolykoyfman
committed
c1ff266
Test: Realign UC-1 policy-pipeline fixtures to ALLOW-only (#141)
anatolykoyfman
committed
68a511e
fix: Rebalance PRB prompt so DENY reasoning stops polluting the ALLOW grant path
anatolykoyfman
committed
5baef99
Test: Realign auto-merged source-deny OPA tests to event-broker arch
anatolykoyfman
committed
fa0ca3c
Fix: Parametrize test_outbound over subjects in policy-pipeline e2e
anatolykoyfman
committed
128c8bb
Docs: Add Testing section to policy-rules-builder spec
anatolykoyfman
committed
643f023
Test: Add live-LLM verification suite for the Policy Rules Builder
anatolykoyfman
committed
361f5fc
Docs: Reconcile PRDs with ALLOW/DENY two-sided policy model
anatolykoyfman
committed
2b45225
Docs: Realign integration-test specs to the AuthBridge OPA enforcement loop
anatolykoyfman
committed
5f51a69

Commits on Aug 14, 2026

Docs: Add plugin catalog (#757)
esnible
authored
3220f7c

Commits on Aug 16, 2026

Commits on Aug 17, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026