M0 + M1 done

RI/config/clients/profiles/finance-payments.yaml

@@ -0,0 +1,17 @@
+# README.md §7.2, §17 (R3), §26 (payment.execute < 10k ALLOW, >= 10k REQUIRE_APPROVAL)
+name: Finance.Payments
+owner: finance-platform
+environment: production
+risk_ceiling: R3
+allowed_tools:
+  - finance.invoice.get
+  - finance.payment.create
+  - finance.payment.execute
+restrictions:
+  max_transaction_value: 10000000
+  approval_threshold: 10000
+credential_policy:
+  workload_identity: true
+  short_lived: true
+audit:
+  level: full

RI/config/clients/profiles/finance-read.yaml

@@ -0,0 +1,12 @@
+# README.md §7.2, §17 (R1)
+name: Finance.Read
+owner: finance-platform
+environment: production
+risk_ceiling: R1
+allowed_tools:
+  - finance.invoice.get
+credential_policy:
+  workload_identity: true
+  short_lived: true
+audit:
+  level: full

RI/config/clients/profiles/sales-approve.yaml

@@ -0,0 +1,18 @@
+# README.md §7.1
+name: Sales.Approve
+owner: sales-platform
+environment: production
+risk_ceiling: R2
+allowed_tools:
+  - sales.customer.search
+  - sales.quote.get
+  - sales.quote.approve
+  - sales.discount.approve
+restrictions:
+  max_transaction_value: 1000000
+  allowed_regions: ["BR-SP", "BR-RJ"]
+credential_policy:
+  workload_identity: true
+  short_lived: true
+audit:
+  level: full

RI/config/clients/profiles/sales-read.yaml

@@ -0,0 +1,15 @@
+# README.md §7.1
+name: Sales.Read
+owner: sales-platform
+environment: production
+risk_ceiling: R1
+allowed_tools:
+  - sales.customer.search
+  - sales.customer.get
+  - sales.order.get
+  - sales.inventory.check
+credential_policy:
+  workload_identity: true
+  short_lived: true
+audit:
+  level: full

RI/config/clients/profiles/sales-write.yaml

@@ -0,0 +1,20 @@
+# README.md §7.1, §41
+name: Sales.Write
+owner: sales-platform
+environment: production
+risk_ceiling: R2
+allowed_tools:
+  - sales.customer.search
+  - sales.customer.get
+  - sales.order.get
+  - sales.inventory.check
+  - sales.quote.create
+  - sales.quote.update
+restrictions:
+  max_transaction_value: 500000
+  allowed_regions: ["BR-SP", "BR-RJ"]
+credential_policy:
+  workload_identity: true
+  short_lived: true
+audit:
+  level: full