From f7e706351c0f9d2409ed77cef9af36e2ab2b470a Mon Sep 17 00:00:00 2001 From: Vitalii Valkov Date: Mon, 10 Aug 2026 05:30:15 +0200 Subject: [PATCH] Let a private resource be granted to an environment A sandbox workload matches no existing principal type. It carries no agent- attribute -- there is no agent class behind it -- and it cannot be a group member, because groups collect users, agents, and apps. Nothing in the access model can name the engineer at a sandbox shell. An ENVIRONMENT principal resolves to every workload running that environment, agent workloads and sandboxes alike. --- proto/agynio/api/networks/v1/networks.proto | 1 + 1 file changed, 1 insertion(+) diff --git a/proto/agynio/api/networks/v1/networks.proto b/proto/agynio/api/networks/v1/networks.proto index 5d064b0..3d0a37d 100644 --- a/proto/agynio/api/networks/v1/networks.proto +++ b/proto/agynio/api/networks/v1/networks.proto @@ -78,6 +78,7 @@ enum PrivateResourceAccessPrincipalType { PRIVATE_RESOURCE_ACCESS_PRINCIPAL_TYPE_USER = 2; PRIVATE_RESOURCE_ACCESS_PRINCIPAL_TYPE_APP = 3; PRIVATE_RESOURCE_ACCESS_PRINCIPAL_TYPE_GROUP = 4; + PRIVATE_RESOURCE_ACCESS_PRINCIPAL_TYPE_ENVIRONMENT = 5; } // Organization-scoped private network.