From c4dbc9d4dafa2b141bd7d494461ca1ac1a88f333 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christian...@>
Date: Sun, 31 May 2026 13:06:18 +0000
Subject: [PATCH] docs: add IAP + Cloud Run setup guide

---
 docs/AGENT_RULEBOOK.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docs/AGENT_RULEBOOK.md b/docs/AGENT_RULEBOOK.md
index f68d88b..6a8bc26 100644
--- a/docs/AGENT_RULEBOOK.md
+++ b/docs/AGENT_RULEBOOK.md
@@ -149,5 +149,29 @@ ALDRI forsvar gamle posisjoner.
 
 Regel: én fil — én eier. Andre foreslår via PR, eier merger.
 
+---
+
+## IAP + Cloud Run Setup
+
+### IAP + Cloud Run — Obligatorisk konfigurasjon
+
+Når Cloud Run eksponeres via IAP + Load Balancer må følgende tre ting være på plass:
+
+1. **Cloud Run ingress: `internal-and-cloud-load-balancing`**
+   ```bash
+   gcloud run services update <SERVICE> --ingress internal-and-cloud-load-balancing
+   ```
+
+2. **IAP service account må ha `run.invoker`-rollen**
+   ```bash
+   gcloud run services add-iam-policy-binding <SERVICE> \
+     --member=serviceAccount:service-<PROJECT_NUMBER>@gcp-sa-iap.iam.gserviceaccount.com \
+     --role=roles/run.invoker
+   ```
+
+3. **IAP policy: `domain:vauco.no` med `roles/iap.httpsResourceAccessor`**
+
+Uten punkt 2 får alle brukere 403 selv om IAP-policy er korrekt.
+
 ---
 EOF v1.2 — 2026-05-21 — OPS-Computer-Hub (Phase 2: HUB_URL locked LIVE, domain status updated)