From 62ac2b4e99dec2005c7c407fe633612578a7907d Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 06:37:38 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- ...apability.authorization.policy-evaluate.md | 129 +++++++++++++----- registry/indexes/capabilities.yaml | 19 +-- 2 files changed, 103 insertions(+), 45 deletions(-) diff --git a/registry/capabilities/capability.authorization.policy-evaluate.md b/registry/capabilities/capability.authorization.policy-evaluate.md index be22db6..c98d0d2 100644 --- a/registry/capabilities/capability.authorization.policy-evaluate.md +++ b/registry/capabilities/capability.authorization.policy-evaluate.md @@ -1,24 +1,32 @@ --- id: capability.authorization.policy-evaluate -name: Authorization Policy Evaluation -summary: Evaluate access decisions from policy-as-code rules for subjects, resources, and actions. -owner: flex-auth +name: Policy evaluation and decision evidence +summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. +owner: access-engine status: draft domain: helix_forge -tags: [authorization, policy, flex-auth] - +tags: +- authorization +- policy +- flex-auth +- security +- netkingdom +- framework-reuse maturity: discovery: current: D4 target: D6 confidence: medium - rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth path. + rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth + path. availability: - current: A2 + current: A4 target: A5 confidence: low - rationale: Policy registry and evaluation logic exist in repo; service packaging evolving. - + rationale: 'Source interface assessed 2026-10-14: Check, batch, list-allowed, + explain, binding, lifetime and decision records. Availability describes the + delivery form, not production acceptance. One PDP owner with per-consumer deployments; + signed envelope production and consumer adoption are distinct.' external_evidence: completeness: level: C2 @@ -26,55 +34,102 @@ external_evidence: confidence: low basis: scope_vs_intent_and_consumer_expectations satisfied_expectations: - - policy-as-code intent documented + - policy-as-code intent documented broken_expectations: - - not yet indexed from flex-auth native registry + - not yet indexed from flex-auth native registry out_of_scope_expectations: - - identity proofing + - identity proofing reliability: level: R1 confidence: low basis: consumer_quality_signals known_reliability_risks: - - early implementation phase - + - early implementation phase discovery: - intent: > - Provide inspectable authorization decisions between verified identity and - protected resources using policy-as-code. + intent: Check, batch, list-allowed, explain, binding, lifetime and decision records includes: - - policy evaluation - - authorization registry - - decision explainability + - Check, batch, list-allowed, explain, binding, lifetime and decision records excludes: - - identity issuance - - authentication protocols - use_cases: [] - + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' availability: - current_level: A2 + current_level: A4 target_level: A5 current_artifacts: - - flex-auth/ + - SCOPE.md + - README.md consumption_modes: - - source module - + - HTTP API + - source relations: depends_on: - - capability.identity.subject-resolution + - capability.identity.subject-resolution related_to: - - capability.feature-control.evaluate - + - capability.feature-control.evaluate + - capability.security.approval-lifecycle + - capability.iam.key-cape + - capability.identity.tenant-facts + - capability.security.zone-reference + - capability.security.maturity-claims consumer_guidance: recommended_for: - - planning authorization layer between identity and resources + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity not_recommended_for: - - feature visibility toggles without policy intent + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct known_limitations: - - maturity evidence is registry-external today + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A2 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +evidence: + documentation: + - SCOPE.md + - README.md --- -# Authorization Policy Evaluation +# Policy evaluation and decision evidence -Policy evaluation from flex-auth sits between identity resolution and protected -systems. \ No newline at end of file +Check, batch, list-allowed, explain, binding, lifetime and decision records. + +## Reuse boundary + +One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 6784c9b..ba6c2d1 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,19 +1,22 @@ version: 1 -updated: '2026-06-16' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.authorization.policy-evaluate - name: Authorization Policy Evaluation - summary: Evaluate access decisions from policy-as-code rules for subjects, resources, - and actions. - vector: D4 / A2 / C2 / R1 + name: Policy evaluation and decision evidence + summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. domain: helix_forge status: draft - owner: flex-auth - path: registry/capabilities/capability.authorization.policy-evaluate.md + owner: access-engine tags: - authorization - policy - flex-auth + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.authorization.policy-evaluate.md consumption_modes: - - source module + - HTTP API + - source