vaultkit 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2eb23b9fcb727367f905e2d62f8b9de36e23cf9a00f54e067f92d6caff9b282
-  data.tar.gz: 8d125c6b810953abd5c0976fe18b2add1c65781431e9a3b2e147d6253fe968bb
+  metadata.gz: 5c88e22778a9f5cd606b8b8965c90c65ee9988085900491cc59e752df4fa5284
+  data.tar.gz: 0c85e8c597f0c845505a6a92002097b3a27d58dc2654cb41beb520bc9099a0c8
 SHA512:
-  metadata.gz: f1780712e8c30407ad5b3319f0df166ba391deff62d79b5e89176867ca4a2d2e8e65b2ec8a4769f28ccd73133bb3e72a87bdf2de3c7ca37ecb79d54ed26ddfba
-  data.tar.gz: b6891fd707489ac9ad584459e1a89dcc9eefaa8eb1a73e19b5b93666bceb34c4cbd84246a1b67eede91453c9da94010f875611b35d09e4441dd11695ca93cdf1
+  metadata.gz: 023b4d4d98941064f67cbd41ddf335c4d2de718b32d68bece7d26db1bcb68e587bb9dcc1b8304300636917864e6dc7ee808057db0dba431c87a1a0102421f0c3
+  data.tar.gz: 88cc76038999e9fb6c2bcd5e09130b20c1dfd0407fac44ba33c0ebaf26d7a8c721c7bdd9657ad535980b4ff12ad06b600d4bc978e849c1e6dfa2fdd399576916

data/lib/vkit/cli/commands/agent_tokens_create_command.rb

@@ -43,11 +43,43 @@ module Vkit
             puts
 
             puts "⚠️  Store this token securely. It cannot be retrieved again."
+
+            warn_if_tenant_scoped(org) unless token["tenant"]
           end
         end
 
         private
 
+        WARNING_NAMES = 5
+
+        # A token with no tenant can't read a tenant-scoped dataset at all:
+        # VaultKit answers it as if the dataset didn't exist. Say so when the
+        # org has any, so the operator isn't left guessing why.
+        def warn_if_tenant_scoped(org)
+          names = tenant_scoped_datasets(org)
+          return if names.empty?
+
+          shown = names.first(WARNING_NAMES).join(", ")
+          shown += ", and #{names.size - WARNING_NAMES} more" if names.size > WARNING_NAMES
+          count = names.size == 1 ? "1 dataset is" : "#{names.size} datasets are"
+
+          puts
+          puts "⚠️  This token has no tenant, and #{count} tenant-scoped in #{org}: #{shown}."
+          puts "   VaultKit answers its requests for them as if they didn't exist (\"Dataset not found\")."
+          puts "   To read them, create a token for one tenant with --tenant."
+        end
+
+        # Names of datasets with a tenant column, from the registry export.
+        # Nothing if the export can't be read: the token is already issued.
+        def tenant_scoped_datasets(org)
+          registry = authenticated_client.get("/api/v1/orgs/#{org}/registries/export")
+          return [] unless registry.is_a?(Hash)
+
+          registry.select { |_name, ds| ds.is_a?(Hash) && !ds["tenant_column"].to_s.empty? }.keys.sort
+        rescue StandardError
+          []
+        end
+
         def build_body(options)
           body = {
             name: options.fetch(:name),

data/lib/vkit/policy/bundle_compiler.rb

@@ -121,9 +121,15 @@ module Vkit
         "allow"
       end
 
+      # One group stays approver_role, as older control planes read it;
+      # several become approver_roles with their approval_mode.
       def self.extract_approval(p)
         return unless p.dig("action", "require_approval")
-        { "approver_role" => p.dig("action", "approver_role") }
+
+        roles = p.dig("action", "approver_roles")
+        return { "approver_role" => p.dig("action", "approver_role") } unless roles
+
+        { "approver_roles" => roles, "approval_mode" => p.dig("action", "approval_mode") || "all" }
       end
 
       def self.extract_masking(p)

data/lib/vkit/policy/match_check.rb

@@ -19,7 +19,10 @@ module Vkit
       SENSITIVITIES = %w[high medium low unknown].freeze
 
       MATCH_KEYS = %w[dataset fields context].freeze
-      FIELD_KEYS = %w[any all contains sensitivity].freeze
+      FIELD_KEYS = %w[any all contains sensitivity usage].freeze
+      # row: the query reads the field value by value (or MIN/MAX of it);
+      # aggregate: it only counts, sums, averages or groups by it.
+      USAGES = %w[row aggregate].freeze
       CONTEXT_KEYS = %w[environment dataset_region requester_role requester_region requester_clearance time].freeze
       ENVIRONMENTS = %w[production staging development sandbox].freeze
       REGIONS = %w[EU US CA APAC].freeze
@@ -86,6 +89,9 @@ module Vkit
         if fields.key?("sensitivity") && !@sensitivities.include?(fields["sensitivity"].to_s)
           problems << "sensitivity #{fields['sensitivity']} never occurs. Use one of: #{@sensitivities.to_a.join(', ')}"
         end
+        if fields.key?("usage") && !USAGES.include?(fields["usage"].to_s)
+          problems << "match.fields.usage #{fields['usage']} isn't one of: #{USAGES.join(', ')}"
+        end
         problems
       end
 

data/lib/vkit/policy/packs/ai_safety/metadata.yaml

@@ -1,8 +1,8 @@
 __pack_meta:
   name: ai_safety
-  version: "2.0.0"
+  version: "2.1.0"
   layer: 30
-  description: "Agents need approval for personal, financial and unreviewed data in production, and for high-sensitivity data anywhere."
+  description: "Agents need approval for personal and unreviewed data in production, for financial data read row by row in production, and for high-sensitivity data anywhere."
   dependencies:
     - starter
   priority_band:

data/lib/vkit/policy/packs/ai_safety/policies/01_require_approval_agents_sensitive_prod.yaml

@@ -1,10 +1,10 @@
 id: ai_require_approval_agents_sensitive_prod
-description: Agents need security approval for personal or financial data in production.
+description: Agents need security approval for personal data in production. Financial data is 04_require_approval_agents_financial_prod.
 priority: 1200
 
 match:
   fields:
-    contains: [pii, financial]
+    contains: [pii]
 
 context:
   environment: production
@@ -13,5 +13,5 @@ context:
 action:
   require_approval: true
   approver_role: security
-  reason: Agents reading personal or financial data in production need security review.
+  reason: Agents reading personal data in production need security review.
   ttl: 1h

data/lib/vkit/policy/packs/ai_safety/policies/04_require_approval_agents_financial_prod.yaml

@@ -0,0 +1,23 @@
+id: ai_require_approval_agents_financial_prod
+description: >-
+  Agents need a person's review to read financial data row by row in production,
+  from security or a finance manager. With financial_compliance installed, the
+  finance manager it already asks for meets this too, so one sign-off covers both.
+  Counts, sums, averages and grouping need no approval.
+priority: 1250
+
+match:
+  fields:
+    contains: [financial]
+    usage: row
+
+context:
+  environment: production
+  requester_role: agent
+
+action:
+  require_approval: true
+  approver_roles: [security, finance_manager]
+  approval_mode: any
+  reason: Agents reading financial data row by row in production need review by security or a finance manager.
+  ttl: 1h

data/lib/vkit/policy/packs/financial_compliance/metadata.yaml

@@ -1,8 +1,8 @@
 __pack_meta:
   name: financial_compliance
-  version: "2.0.0"
+  version: "2.1.0"
   layer: 40
-  description: "Finance approval for financial data in production, and short-lived grants for financial fields."
+  description: "Finance approval for reading financial data row by row in production (totals and averages need none), and short-lived grants for financial fields."
   dependencies:
     - starter
   priority_band:

data/lib/vkit/policy/packs/financial_compliance/policies/01_require_approval_financial_prod.yaml

@@ -1,10 +1,11 @@
 id: fin_require_approval_financial_prod
-description: A finance manager approves requests for financial data in production.
+description: A finance manager approves reading financial data row by row in production. Counts, sums, averages and grouping need no approval; MIN and MAX return a single value, so they do.
 priority: 2100
 
 match:
   fields:
     contains: [financial]
+    usage: row
 
 context:
   environment: production
@@ -12,5 +13,5 @@ context:
 action:
   require_approval: true
   approver_role: finance_manager
-  reason: Financial data in production needs finance approval.
+  reason: Reading financial data row by row in production needs finance approval.
   ttl: 30m

data/lib/vkit/policy/policy_validator.rb

@@ -80,7 +80,7 @@ module Vkit
 
         when "require_approval"
           require_reason!(action, prefix)
-          require_string!(action, "approver_role", prefix)
+          validate_approvers!(action, prefix)
 
         when "mask"
           # masking is optional, but if present must be valid
@@ -93,6 +93,59 @@ module Vkit
         validate_ttl!(action["ttl"], prefix) if action.key?("ttl")
       end
 
+      APPROVAL_MODES = %w[all any].freeze
+
+      # One group (approver_role), or several (approver_roles) with
+      # approval_mode: all (the default, every group signs off) or any (one
+      # of them does).
+      def self.validate_approvers!(action, prefix)
+        single = action["approver_role"]
+        several = action["approver_roles"]
+
+        if single && several
+          raise ValidationError, <<~MSG
+            #{prefix}Set approver_role or approver_roles, not both.
+          MSG
+        end
+
+        if several.nil?
+          require_string!(action, "approver_role", prefix)
+          if action.key?("approval_mode")
+            raise ValidationError, <<~MSG
+              #{prefix}approval_mode only applies to approver_roles (several groups).
+            MSG
+          end
+          return
+        end
+
+        unless several.is_a?(Array) && several.any? && several.all? { |r| r.is_a?(String) && !r.strip.empty? }
+          raise ValidationError, <<~MSG
+            #{prefix}approver_roles must be a list of approver group names.
+
+            Example:
+
+              action:
+                require_approval: true
+                approver_roles: [security, data_owner]
+                approval_mode: any
+          MSG
+        end
+
+        if several.uniq.size != several.size
+          raise ValidationError, "#{prefix}approver_roles lists a group more than once.\n"
+        end
+
+        mode = action.fetch("approval_mode", "all")
+        return if APPROVAL_MODES.include?(mode.to_s)
+
+        raise ValidationError, <<~MSG
+          #{prefix}approval_mode must be all (every group signs off) or any (one of them does).
+
+          Got:
+            approval_mode: #{mode.inspect}
+        MSG
+      end
+
       def self.require_reason!(action, prefix)
         reason = action["reason"]
         return if reason.is_a?(String) && !reason.strip.empty?

data/lib/vkit/policy/schema/policy_bundle.schema.json

@@ -214,7 +214,8 @@
                   "contains": {
                     "type": "array",
                     "items": { "type": "string" }
-                  }
+                  },
+                  "usage": { "type": "string", "enum": ["row", "aggregate"] }
                 }
               },
               "context": {
@@ -293,7 +294,14 @@
             "type": "object",
             "additionalProperties": false,
             "properties": {
-              "approver_role": { "type": "string" }
+              "approver_role": { "type": "string" },
+              "approver_roles": {
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": { "type": "string", "minLength": 1 }
+              },
+              "approval_mode": { "type": "string", "enum": ["all", "any"] }
             }
           },
 

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-07 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -101,6 +101,7 @@ files:
 - lib/vkit/policy/packs/ai_safety/policies/01_require_approval_agents_sensitive_prod.yaml
 - lib/vkit/policy/packs/ai_safety/policies/02_require_approval_agents_high_sensitivity.yaml
 - lib/vkit/policy/packs/ai_safety/policies/03_require_approval_agents_unknown_prod.yaml
+- lib/vkit/policy/packs/ai_safety/policies/04_require_approval_agents_financial_prod.yaml
 - lib/vkit/policy/packs/financial_compliance/metadata.yaml
 - lib/vkit/policy/packs/financial_compliance/policies/01_require_approval_financial_prod.yaml
 - lib/vkit/policy/packs/financial_compliance/policies/02_short_ttl_for_financial_grants.yaml