Authorization at the server side layer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadOnlyOnSpecificReportsBucket",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::reports-readonly-prod",
        "arn:aws:s3:::reports-readonly-prod/*"
      ]
    },
    {
      "Sid": "DenyDestructiveOnAnyResourceWithoutAgentTag",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutBucketPolicy",
        "s3:PutBucketLifecycleConfiguration",
        "s3:PutBucketAcl"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceTag/agentic-covenants/agent-allowed": "claude-code-prod"
        }
      }
    },
    {
      "Sid": "DenyAllOtherS3Actions",
      "Effect": "Deny",
      "NotAction": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyIAMEscalationPrimitives",
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:CreateRole",
        "iam:CreatePolicy",
        "iam:CreatePolicyVersion",
        "iam:SetDefaultPolicyVersion",
        "iam:AttachUserPolicy",
        "iam:AttachRolePolicy",
        "iam:AttachGroupPolicy",
        "iam:PassRole",
        "iam:PutUserPolicy",
        "iam:PutRolePolicy",
        "iam:PutGroupPolicy",
        "iam:UpdateAssumeRolePolicy"
      ],
      "Resource": "*"
    }
  ]
}

#!/usr/bin/env bash
# ABOUTME: Git server-side pre-receive hook. Cannot be bypassed by --no-verify. Install on every Git server in the org.
# ABOUTME: Blocks force-pushes to main, edits to protected paths from non-CODEOWNERS, and any diff containing secrets.

set -euo pipefail

PROTECTED_PATHS=(
  'infrastructure/prod/'
  '.github/workflows/'
  'secrets/'
  '.claude/'
)

ZERO_SHA="0000000000000000000000000000000000000000"
EXIT_CODE=0

while read -r oldrev newrev refname; do

  # 1. Reject force-pushes to main / master / release branches.
  case "$refname" in
    refs/heads/main|refs/heads/master|refs/heads/release/*)
      if [[ "$oldrev" != "$ZERO_SHA" && "$newrev" != "$ZERO_SHA" ]]; then
        if ! git merge-base --is-ancestor "$oldrev" "$newrev" 2>/dev/null; then
          echo "BLOCKED: force-push to ${refname} is not permitted" >&2
          EXIT_CODE=1
          continue
        fi
      fi
      ;;
  esac

  # Skip the per-commit checks on branch deletion.
  if [[ "$newrev" == "$ZERO_SHA" ]]; then
    continue
  fi

  # 2. Reject edits to protected paths from authors not listed in CODEOWNERS.
  if [[ "$oldrev" == "$ZERO_SHA" ]]; then
    # New branch: scan all reachable commits.
    CHANGED=$(git diff-tree --no-commit-id --name-only -r "$newrev")
  else
    CHANGED=$(git diff --name-only "$oldrev" "$newrev")
  fi

  AUTHOR_EMAIL=$(git log -1 --pretty=format:%ae "$newrev")

  while IFS= read -r path; do
    [[ -z "$path" ]] && continue
    for protected in "${PROTECTED_PATHS[@]}"; do
      if [[ "$path" == "$protected"* ]]; then
        if ! git show "$newrev:CODEOWNERS" 2>/dev/null \
            | grep -E "^\s*${protected}" \
            | grep -q "$AUTHOR_EMAIL"; then
          echo "BLOCKED: ${path} is a protected path; ${AUTHOR_EMAIL} is not in CODEOWNERS for it" >&2
          EXIT_CODE=1
        fi
      fi
    done
  done <<< "$CHANGED"

  # 3. Run gitleaks against the diff. Skipped if gitleaks is not installed
  # so the hook fails closed only on real findings, not infrastructure issues.
  if command -v gitleaks >/dev/null 2>&1; then
    DIFF_OUTPUT=$(git diff "$oldrev..$newrev" 2>/dev/null || true)
    if [[ -n "$DIFF_OUTPUT" ]]; then
      if ! echo "$DIFF_OUTPUT" \
          | gitleaks detect --source - --no-banner --no-color --exit-code 1 >/dev/null 2>&1; then
        echo "BLOCKED: secrets detected by gitleaks in ${refname} (${oldrev:0:8}..${newrev:0:8})" >&2
        EXIT_CODE=1
      fi
    fi
  else
    echo "WARN: gitleaks not installed on server; secret-scan step skipped" >&2
  fi

done

exit "$EXIT_CODE"

# ABOUTME: Kyverno ClusterPolicy denying ClusterRoleBindings, wildcard verbs, and prod-namespace bindings on agent SAs.
# ABOUTME: Verified against Kyverno CLI 1.17.1 on 2026-08-17 by tests/kyverno/. validationFailureAction must be Enforce, not Audit.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: agents-no-cluster-roles
  annotations:
    policies.kyverno.io/title: Agents must use namespace-scoped Roles only
    policies.kyverno.io/category: Agentic Covenants / Authorization
    policies.kyverno.io/severity: high
spec:
  validationFailureAction: Enforce
  background: true
  rules:

  - name: deny-clusterrolebinding-for-agent-sa
    match:
      any:
      - resources:
          kinds: [ClusterRoleBinding]
    validate:
      message: >-
        Agents must use namespace-scoped RoleBindings, never ClusterRoleBindings.
        ServiceAccounts in namespaces matching agent-* may not be ClusterRoleBinding subjects.
      foreach:
      - list: "request.object.subjects"
        deny:
          conditions:
            all:
            - key: "{{ element.kind }}"
              operator: Equals
              value: "ServiceAccount"
            - key: "{{ element.namespace }}"
              operator: AnyIn
              value: ["agent-*"]

  - name: deny-wildcard-verbs-in-roles
    match:
      any:
      - resources:
          kinds: [Role, ClusterRole]
    validate:
      message: >-
        Wildcard verbs are not permitted. List the verbs explicitly: get, list, watch, etc.
      # foreach/deny rather than a pattern anchor: verbs is a list of strings,
      # so a nested map pattern never matches and denies every Role including
      # correctly-scoped ones. Verified by tests/kyverno/.
      foreach:
      - list: "request.object.rules[]"
        deny:
          conditions:
            any:
            - key: "{{ contains(element.verbs, '*') }}"
              operator: Equals
              value: true

  - name: deny-wildcard-resources-in-roles
    match:
      any:
      - resources:
          kinds: [Role, ClusterRole]
    validate:
      message: >-
        Wildcard resources are not permitted. List resources explicitly, including subresources
        such as pods/exec where access must be explicit.
      foreach:
      - list: "request.object.rules[]"
        deny:
          conditions:
            any:
            - key: "{{ contains(element.resources, '*') }}"
              operator: Equals
              value: true

  - name: deny-agent-sa-binding-into-prod-namespaces
    match:
      any:
      - resources:
          kinds: [RoleBinding]
          namespaces:
          - "prod-*"
          - "production"
          - "prd"
    validate:
      message: >-
        Agent ServiceAccounts (namespaces matching agent-*) cannot be bound into production namespaces.
        Production work belongs to a human operator with their own credentials.
      foreach:
      - list: "request.object.subjects"
        deny:
          conditions:
            all:
            - key: "{{ element.kind }}"
              operator: Equals
              value: "ServiceAccount"
            - key: "{{ element.namespace }}"
              operator: AnyIn
              value: ["agent-*"]

  - name: require-explicit-resource-on-rolebinding
    match:
      any:
      - resources:
          kinds: [RoleBinding, ClusterRoleBinding]
    validate:
      message: >-
        RoleBinding/ClusterRoleBinding must reference a Role or ClusterRole that exists.
        roleRef.name must be set.
      pattern:
        roleRef:
          name: "?*"