[RBAC PR 4 follow-up] Add scoped restrictive enforcement

[philipfweiss]

Tracking: #2234 (step 4).

With a permissive default, a missing grant allows every ordinary metadata mutation. Operators need a way to require explicit grants for shared.main writes while unrelated namespaces keep their current behavior.

This draft adds a RESTRICTIVE_SCOPES setting:

• Entries use action:scope_type:scope_value, such as write:node:shared.main.*.
• An admin bypass or explicit principal, group, or service-account grant can approve a matching request.
• A matching rule denies before the default-access role and permissive fallback are considered.
• Actions match exactly, so WRITE, DELETE, and MANAGE are configured separately while READ and EXECUTE remain open.
• Settings validation rejects unknown actions, resource types, and patterns outside the shared scope grammar during startup.
• Decisions identify the matched restrictive rule or fallback source in their reason.

This draft uses an explicit scope set for namespace boundaries and preserves existing scope meanings. Protecting shared.main for one action requires the namespace root, namespace subtree, and node subtree:

write:namespace:shared.main
write:namespace:shared.main.*
write:node:shared.main.*

The empty default leaves existing deployments unchanged. Rollout begins only when an operator supplies rules and provisions the matching grants.

---

Verification:

Started a local FastAPI harness on :18084 that routed HTTP requests through RBACAuthorizationService with DEFAULT_ACCESS_POLICY=permissive and this write boundary:

RESTRICTIVE_SCOPES=[
  "write:namespace:shared.main",
  "write:namespace:shared.main.*",
  "write:node:shared.main.*"
]

1. An ungranted write inside the boundary was denied.

curl http://127.0.0.1:18084/check/write/node/shared.main.revenue
# {"approved":false,"reason":"restrictive_scope:write:namespace:shared.main.*"}

2. An explicit grant approved the same request. A default-role grant remained denied.

curl -H 'x-grant: explicit' http://127.0.0.1:18084/check/write/node/shared.main.revenue
# {"approved":true,"reason":"explicit_grant"}

curl -H 'x-grant: default' http://127.0.0.1:18084/check/write/node/shared.main.revenue
# {"approved":false,"reason":"restrictive_scope:write:namespace:shared.main.*"}

3. Read access inside the boundary and writes outside it followed the permissive baseline.

curl http://127.0.0.1:18084/check/read/node/shared.main.revenue
# {"approved":true,"reason":"default_access_policy_permissive"}

curl http://127.0.0.1:18084/check/write/node/shared.other.revenue
# {"approved":true,"reason":"default_access_policy_permissive"}

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	86e8e9a
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a86331c6c71340009857a36