A new starter's access, set up

workflow.yaml is AWML 0.4, as it was pushed. The registry draws, checks and fits it converted to AWML 0.8.

# A new starter's access. The hire record holds personal data and stays with people ops. A standing
# rule passes IT only the name, role and start date, and no IT step reads the record itself. Admin
# access waits for an IT approver, whose own step is their yes. The company is fictional.
awml: "0.4"
title: A new starter's access, set up
scopes:
  - { id: people, label: "people ops: HR team", processing: { anthropic: any } }
  - { id: it, label: "IT: service desk, IT approvers", processing: { anthropic: any } }
parts:
  - { id: hired, kind: trigger, label: "A new hire record", wait: P1D, in: people }
  - { id: record, kind: context, label: "The hire record", in: people }
  - { id: accounts, kind: code, op: do, label: "Create the standard accounts for the role", in: it }
  - { id: directory, kind: connector, label: "The directory, IT's service account", in: it }
  - { id: asked, kind: context, label: "Extra access the manager asked for", in: it }
  - { id: policy, kind: context, label: "The access policy", at: it/policies, in: it }
  - { id: check, kind: ai, op: check, label: "Check the extra access against the policy", in: it }
  - { id: approve, kind: person, op: do, label: "Approve the extra access and grant it", in: it }
  - { id: grant, kind: outside, label: "Grant admin access: Ask", in: it }
lines:
  - { from: hired, to: record, kind: start }
  - { from: record, to: accounts, kind: publish, label: "standing rule: name, role and start date only" }
  - { from: accounts, to: directory, kind: data }
  - { from: accounts, to: check, kind: data, label: "the standard accounts" }
  - { from: asked, to: check, kind: data }
  - { from: policy, to: check, kind: data }
  - { from: record, to: check, kind: refused, label: "never read by IT" }
  - { from: check, to: approve, kind: data, label: "the verdict" }
  - { from: approve, to: grant, kind: data }