SmartExchange · .NET 10 · Chapter 08
Deployment and validation
Read-only runtime review on 2026-10-27: aks-smartcloud-nonprod / dev-authorization. This documentation update did not change cluster configuration or policies.
Installed resource policies
| ConfigMap | Current live behavior | Source alignment |
|---|---|---|
| policy-person | exportAdmin + older Person/Company attribute paths. | Grant-based Person policy is in source, not yet deployed. |
| policy-company | exportAdmin + older Company attributes. | Grant-based Company policy is in source, not yet deployed. |
| policy-interested-party | New read scopes + imported Project Scope role; existing export rules retained. | New read path matches the shared grants contract. |
| policy-investor | exportAdmin/export explicitly EFFECT_DENY. | Live rule differs from repository ALLOW; preserve/review this edit. |
| policy-cash-flow | exportAdmin/export EFFECT_ALLOW. | Installed. |
Eight installed derived-role sets
| ConfigMap / YAML snapshot | Derived role | Imported by live resource policy |
|---|---|---|
derived-role-company-person-read | company_with_readable_person | — |
derived-role-interested-party-investor-read | interested_party_with_readable_investor | — |
derived-role-interested-party-project-read | interested_party_with_readable_project | — |
derived-role-interested-party-project-scope | interested_party_in_project_scope | InterestedParty/read |
derived-role-investor-interested-party-read | investor_with_readable_interested_party | — |
derived-role-investor-project-read | investor_with_readable_project | — |
derived-role-person-company-read | person_with_readable_company | — |
derived-role-project-interested-party-read | project_with_readable_interested_party | — |
The first seven definitions express access through a related resource’s read grant. They are installed but not imported by the current resource policies. The eighth, Project Scope, is imported by InterestedParty. A definition alone grants no action. YAML regeneration on CRM changes is not wired into the registry/build.
Connection shared by all consumers
{
"Authorization": {
"Cerbos": {
"Address": "http://cerbos.dev-authorization.svc.cluster.local:3593",
"TimeoutSeconds": 5
}
}
}The connection is present in microapp-config in dev-microapps and dev-web. AuthorizationOptions.Cerbos contains Address and TimeoutSeconds; there is no central Mode. gRPC uses 3593; HTTP API/health uses 3592.
MicroApplication.OnInitialization() binds this section and creates CerbosAuthorizationPolicyClient. The package currently takes options; automatic shared configuration loading is pending. Authorization enablement remains the application’s choice.
Evidence and next steps
- 2026-10-27: live ConfigMaps reviewed, pod 2/2 Ready, mounted policies compiled with
cerbos compile --skip-tests /policies. - 2026-10-26: Project Scope verification recorded 27 live API scenarios and 51 record/action decisions. This is policy evidence, not a database export test.
- Pending: build/run the latest application changes, publish shared packages, align old live policies, verify real adapter → Cerbos → SQL execution and integrate Web API.
Each policy/derived-role set has its own ConfigMap, projected into the Cerbos pod. The sync container publishes changes to the watched policy directory. Do not blanket-apply repository policies over live edits. WebManager source lists both types with distinct icons. DEV currently runs image 20261026.2; UI behavior was not rechecked in this documentation audit.
YAML downloads are dated runtime snapshots, not installation manifests or an instruction to overwrite the live configuration.
Equal examples, accurately labelled deployment state
| Artifact | Person export | InterestedParty export |
|---|---|---|
| CRM relation / registry | Implemented | Implemented |
| Derived-role set | person_company_read · installed | interested_party_project_scope · installed |
| presentation-demo policy | Documentation only; not deployed | Documentation only; not deployed |
| Current default integration | Inline grant-based relation in source; live policy uses older attributes. | Scoped role enables read. Export still uses the retained older paths. |
| Export example verification | Expected AST/SQL only; no new real export run. | Expected AST/SQL only; recorded read checks do not verify export. |
The paired examples are proposals that reuse installed role definitions, not a claim that the live default policies already match. This documentation update does not deploy them or change ACL assignments.