refactor: centralize runtime RBAC policy #33

2026-05-21T18:22:30Z

hongming commented

2026-05-21 18:22:30 +00:00

What

Add molecule_runtime.rbac_policy as the single source of truth for built-in RBAC role permissions and permission evaluation.
Rewire audit.py and a2a_tools_rbac.py to import the shared policy instead of carrying duplicate role maps / permission loops.
Add regression coverage proving audit and A2A helpers share the same role-permission object.

Why

The runtime had two copies of the RBAC role table. That can drift and produce inconsistent behavior between MCP tool gates and built-in audit/governance paths.

Verification

/tmp/runtime-local-311-venv/bin/python -m pytest tests/test_rbac_policy_ssot.py tests/test_audit.py tests/test_a2a_mcp_server.py -q
/tmp/runtime-local-311-venv/bin/python -m pytest -q

Tier

Tier 2 — runtime authorization policy refactor with regression coverage.

## What - Add molecule_runtime.rbac_policy as the single source of truth for built-in RBAC role permissions and permission evaluation. - Rewire audit.py and a2a_tools_rbac.py to import the shared policy instead of carrying duplicate role maps / permission loops. - Add regression coverage proving audit and A2A helpers share the same role-permission object. ## Why The runtime had two copies of the RBAC role table. That can drift and produce inconsistent behavior between MCP tool gates and built-in audit/governance paths. ## Verification - /tmp/runtime-local-311-venv/bin/python -m pytest tests/test_rbac_policy_ssot.py tests/test_audit.py tests/test_a2a_mcp_server.py -q - /tmp/runtime-local-311-venv/bin/python -m pytest -q ## Tier Tier 2 — runtime authorization policy refactor with regression coverage.

hongming added 1 commit 2026-05-21 18:22:31 +00:00

refactor: centralize runtime rbac policy

ci / lint (pull_request) Successful in 1m1s

Details

ci / unit-tests (pull_request) Successful in 1m29s

Details

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s

Details

ci / smoke-install (pull_request) Successful in 1m12s

Details

ci / build (pull_request) Successful in 1m19s

Details

4a71353aaa

infra-runtime-be approved these changes 2026-05-21 18:28:33 +00:00

infra-runtime-be left a comment

Approved: RBAC policy is centralized in runtime SSOT with focused regression coverage and green CI.

core-devops approved these changes 2026-05-21 18:28:34 +00:00

core-devops left a comment

Approved: RBAC policy is centralized in runtime SSOT with focused regression coverage and green CI.

hongming merged commit 33889ef94d into main

2026-05-21 18:28:34 +00:00

hongming referenced this issue from a commit

2026-05-21 18:28:35 +00:00

Merge pull request #33 from fix/rbac-policy-ssot

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-runtime#33