Entitlements

Gate rules on team membership, catalog ownership, work mode, and live tickets.

Requiring entitlements

A rule with requires matches only when every listed requirement is satisfied (any one value within each list):

{ "id": "team-write", "action": "git.push", "repository": "acme/payments-api",
  "ref": "refs/heads/agent/*", "effect": "allow",
  "requires": { "teams": ["payments"], "modes": ["build"] } }
 
{ "id": "hotfix", "action": "git.push", "repository": "acme/payments-api",
  "ref": "refs/heads/main", "effect": "approval", "approvals": 2,
  "requires": { "elevation": "jira" } }

Fail-safe evaluation

Each requirement is satisfied, unsatisfied, or unknown (a source failed or input is missing).

• allow rules take part only when satisfied.
• deny and approval rules take part unless unsatisfied.

An outage can therefore never lift a restriction or let a broader allow through.

Sources

"entitlements": {
  "static": { "path": "/etc/agentgate/directory.json" },
  "githubTeams": { "org": "acme", "installationId": 1, "teams": ["payments"] },
  "jira": { "baseUrl": "https://acme.atlassian.net", "tokenFile": "/run/secrets/jira_token", "allowedStatuses": ["In Progress"] }
}

static

A JSON export from AD/Entra or Backstage, written by a scheduled job and read on each resolution:

{ "humans": { "[email protected]": { "groups": [], "teams": [], "owns": [] } } }

githubTeams

Checks active team membership for the assertion's ghLogin, using an org-scoped token with Members: read.

jira

For tasks like jira:PAY-12, sets elevation when the issue status is allowed and its assignee's email equals the runtime's human.

Caching

Envelopes are cached per assertion jti (static mode: per runtimeId). Positive results live 5 minutes; results with a failed source, 30 seconds. SIGHUP drops the cache. Audit records and approvals carry the envelope summary so reviewers see why a rule matched.