# Authorisation on tool-call parameters, not just the tool name.
#
# The ACL answers "may this identity call create-product?". Nothing answered
# "may it call it with *these* arguments" — and `write` authorises writing, not
# this particular record. The read cap counts calls, so one call asking for a
# hundred thousand rows costs the same as one asking for ten.
#
# Enforced here rather than in an agent, because an agent that has been talked
# into something is exactly the case this exists for. The policy lives once, in
# k8s-platform/opa/policy.rego, and every domain asks the same server.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-workforce-mcp-opa
  namespace: ${NAMESPACE}
plugin: opa
config:
  opa_protocol: http
  opa_host: opa.opa.svc.cluster.local
  opa_port: 8181
  opa_path: /v1/data/kong
  # The decision is about the arguments, so the arguments have to reach the
  # decision point. Without this OPA sees a method and a path and nothing it
  # can rule on.
  include_parsed_json_body_in_opa_input: true
  include_body_in_opa_input: false
  include_route_in_opa_input: false