Create cyborg/policies/attributes.py with DocumentedRuleDefault
entries for all four attribute operations: get_one, get_all, create,
and delete.
Read operations use project_manager_or_admin, granting the manager
persona visibility into accelerator capability metadata for capacity
planning. Attribute create and delete remain restricted to cloud
admins as attributes describe shared physical infrastructure
properties populated by cyborg-agent during hardware discovery.
Each new policy includes a deprecated_rule bridge matching the
current legacy check string (rule:admin_api) so that existing
deployments continue to work with enforce_new_defaults=False.
Update cyborg/policies/__init__.py to load the new attribute policies
and stop loading the legacy attribute_policies list from
cyborg/common/policy.py.
Partial-Implements: blueprint consistent-and-secure-rbac
Assisted-By: pi opus-4.6 (orchestrator)
Assisted-By: pi sonnet-4.6 (implementer)
Assisted-By: pi gpt-5.5 (reviewer)
Change-Id: Ic3c016148696929436e481b25045d6f3fb67beb7
Signed-off-by: Sean Mooney <work@seanmooney.info>
Sean Mooney
b12e90d26a