mlsmaycon c995d89830 Redact provider connection config for read-only viewers and canonicalize Bedrock ids in setup ...

The provider read grant now serves usage_viewer the display surface only:
the manager blanks upstream URL, operator-typed header values, identity
header names, and the TLS override for callers holding read without
update. The me/setup model intersection compares declared ids through the
same normalization the proxy's parser applies, so a Bedrock declaration
in region/version form still advertises when its canonical id is
allowlisted. Docs and comments now say account-wide for the logs
exclusion and describe the real group source shared with enforcement.

2026-08-27 08:07:20 +00:00

..

modules

[management] Resolve agent network permissions per submodule (#7030)

2026-08-03 12:45:17 +02:00

operations

[management] permissions manager use crud operations (#3690)

2025-04-16 17:25:03 +02:00

roles

Redact provider connection config for read-only viewers and canonicalize Bedrock ids in setup

2026-08-27 08:07:20 +00:00

agent_network_roles_test.go

[management] Self-scope usage and log reads; give usage_viewer the filter resources

2026-08-18 17:20:08 +00:00

manager_mock.go

[client, management] switch to go.uber.org/mock (#7253)

2026-08-20 11:53:19 +02:00

manager_test.go

[management] Resolve agent network permissions per submodule (#7030)

2026-08-03 12:45:17 +02:00

manager.go

[client, management] switch to go.uber.org/mock (#7253)

2026-08-20 11:53:19 +02:00