Kyle Isom c67601c7f6 Allow all authenticated users to push/pull (not just human+user role) ...

The previous default policy required both AccountTypes=["human"] and
Roles=["user"], but MCIAS validate responses don't reliably include
these fields. For a private registry, any successfully authenticated
caller should have content access. Admin-only operations (policy
management) still require the admin role.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-25 23:02:53 -07:00

959 B

Raw Blame History

View Raw