docs: reflect changes from lamassuiot#685 (chore(authz): add default actions, route constraints and OTEL tracing to the au…)

[gh-lamassu-docsagent]

Documents the user-facing changes from lamassuiot/lamassuiot.

Source: lamassuiot/lamassuiot#685

Summary

Now let me examine the source diff for the user-facing files.
I now have a clear picture of the changes. Let me record verified facts and then assess existing docs coverage.
Now let me read the source repo's authz spec to ground the HTTP schema contract details.
Let me verify what the ext_authz controller actually logs, so any diagnostics documentation stays accurate.
Let me verify the precedence behavior against the tests in the source repo.
All behaviors verified against source code and tests. Let me record the plan, then edit the English page.
English page done. Now the Spanish page — the same five edits mirrored.
Both locales updated. Now the review pass — let me re-read the changed regions of both pages to verify structure and coherence.
Let me polish one sentence in both diagnostics sections, then verify the Spanish page.
One coherence improvement: the ext_authz decision flow should acknowledge the policy's own param_constraints in step 7, so readers don't assume route constraints are the only narrowing mechanism.
Edits are complete. Running the build gate now.
I don't have a shell/execute tool available in this session, so I cannot invoke ./context/check-build directly. I'll compensate with a rigorous manual build-readiness verification of every construct the check would flag, and flag this clearly in the handoff (the application re-runs the same build gate after I finish).
All JSX tags balanced, all code fences paired, and EN/ES structures align line-for-line. Let me confirm the step-7 edits landed and the frontmatter is intact in both files.
All verifications pass. Finalizing my working notes and then delivering the summary.
All done. Here is the summary.

---

Docs update summary (for the docs PR body)

Feature assessed: lamassuiot/lamassuiot#685 adds three user-facing HTTP authorization capabilities to the authz engine: (1) skip_authz: true route flag (authentication required, policy grant skipped — e.g. /openapi.json, health/version), (2) schema-level base_paths + default_action: allow|deny fallback for unmapped paths (the packaged Job Manager schema now ships with an explicit deny), and (3) param_constraints on policy HTTP rules, pinning a granted action to a literal request value (regex-captured path segment, query, header, or JSON body field) independent of subject attributes. The PR body's "Known limitation" about cross-schema default_action conflicts is stale — the shipped evaluateHTTPOverride resolves route matching across all schemas before any fallback (covered by TestEngineCheckHTTPRequest_SchemaDefaultActionDoesNotOverrideOtherSchemasRoute), so the docs describe the implemented behavior. The OTEL additions are internal spans; they are surfaced in docs only as one diagnostics aid, not as a feature write-up.

What changed: platform/pki/access-control.mdx and its Spanish twin access-control.es.mdx (the single home of this feature; no new page, no sidebar change):

• New section “Authentication-only routes and unmapped paths” / “Rutas solo de autenticación y rutas no mapeadas” documenting skip_authz (auth still required first, no constraints allowed, wins over other schemas' routes/defaults) and base_paths/default_action (explicit route anywhere wins; longest overlapping prefix decides; conflicting duplicate base paths fail schema load), plus a warning callout that these decisions bypass policies.
• The HTTP rules section now documents param_constraints with a worked example (granting system-info-read only for system 1), its validation rules, fail-closed semantics, AND-combination, and backward compatibility.
• The ext_authz decision flow (step 7) acknowledges policy-side literal pinning.
• Diagnostics gained “Access appears without a policy grant” / “Aparece acceso sin política concedida”, and the 403 explanation now mentions the new engine.CheckHTTP OpenTelemetry span (with authz.allowed and matched policy/principal attributes) available when chart instrumentation is enabled.
• Operational checklist gained a review line for skip_authz/default_action when integrating or upgrading a service.

Locale pairing: English …/access-control.mdx and Spanish …/access-control.es.mdx were updated together with equivalent scope, examples, warnings, headings and structure (fence/Callout layouts align 1:1). Canonical routes touched (no new/renamed pages): /docs/platform/pki/access-control and /docs/es/platform/pki/access-control.

Build-gate caveat: no shell/execute tool is exposed in this session, so I could not run ./context/check-build myself. I instead manually verified every failure mode the check targets for both edited files: frontmatter intact and valid, locale pairs correct, meta.json untouched (in-page edits only), all JSX tags balanced (only pre-existing <Callout>/<Steps>/<Step> components, 7/7 open/close per file), all {/< confined to code spans or fences, no import/export added, no internal links added, no pages created or deleted. The application's mandatory post-finish build performs the same gate before anything is published; in the preview, verify pr-<N>/platform/pki/access-control (both locales via the change switch).

[gh-lamassu-docsagent]

📖 Preview: https://www.lamassu.io/docs/pr-preview/pr-28/

Rebuilt on every push to this PR. May take a minute to appear after GitHub Pages picks up the gh-pages commit.