{
  "_comment": [
    "Wazuh MANAGER API policy scoping a tenant to its own agent group.",
    "This is separate from the indexer security role: the indexer role fences",
    "the data, this policy fences the manager API on port 55000.",
    "",
    "Apply with:",
    "  POST /security/policies",
    "then attach it to a role, and the role to the user, using the endpoints",
    "  POST /security/roles",
    "  POST /security/roles/{role_id}/policies",
    "  POST /security/users/{user_id}/roles",
    "with the parameters given in the API reference for each.",
    "(Remove this _comment key before sending the body.)",
    "",
    "Source: the agent:group resource and the policy body shape are in the",
    "5.0.0 server API specification, x-rbac-catalog section:",
    "https://documentation.wazuh.com/5.0-beta/user-manual/api/reference.html",
    "",
    "Actions deliberately NOT included, because they take the resourceless",
    "'*:*:*' resource and therefore cannot be limited to one tenant:",
    "  agent:create, group:create, agent:uninstall,",
    "  enrollment_token:create, enrollment_token:read, enrollment_token:delete",
    "Keep those in the onboarding role your automation uses, never in a",
    "tenant role.",
    "",
    "Also deliberately absent: agent:read_secrets, which reads the agents'",
    "pre-shared keys from client.keys in clear."
  ],
  "name": "tenant_acmeretail_agents",
  "policy": {
    "actions": [
      "agent:read",
      "agent:restart",
      "agent:reload",
      "agent:scan_vulnerability"
    ],
    "resources": [
      "agent:group:t-acmeretail"
    ],
    "effect": "allow"
  }
}