Admit initial decision lifecycle audience and patch evaluator dependencies
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
c0f3f25be2
commit
d2d0b6feeb
25 changed files with 2644 additions and 102 deletions
|
|
@ -0,0 +1,303 @@
|
|||
{
|
||||
"policy_id": "informed-decision.compact-sitting",
|
||||
"policy_version": "v11",
|
||||
"note": "Offline request/response fixtures. Shipped admitted sets are empty, so attribute_eligible is not in this file. An allow here is an exact-record pin, not proof of a live approval.",
|
||||
"cases": [
|
||||
{
|
||||
"id": "exact-record-allow",
|
||||
"kind": "exact",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
|
||||
"request": {
|
||||
"id": "exact-record-allow",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-record-wrong-digest",
|
||||
"kind": "exact",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "exact-record-wrong-digest",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-record-with-attribute-context",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
|
||||
"request": {
|
||||
"id": "exact-record-with-attribute-context",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "read",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "exact-pin-mismatch-not-rescued",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "exact-pin-mismatch-not-rescued",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-unknown-class",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "unknown_class"},
|
||||
"request": {
|
||||
"id": "attribute-unknown-class",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "decline",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"kind": "attribute",
|
||||
"assurance": "stale",
|
||||
"expect": {"effect": "deny", "reason": "stale_mfa"},
|
||||
"request": {
|
||||
"id": "attribute-stale-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": false,
|
||||
"memo_version": 1,
|
||||
"approval_id": "not-a-uuid",
|
||||
"approval_binding_digest": "sha256:wrong"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-review-group",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "review_group_not_verified"},
|
||||
"request": {
|
||||
"id": "attribute-review-group",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["other-group"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "discuss",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 2,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-bad-memo-id",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "resource_refused"},
|
||||
"request": {
|
||||
"id": "attribute-bad-memo-id",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "return",
|
||||
"resource": {"id": "memo:NO", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-list-stays-exact",
|
||||
"kind": "attribute",
|
||||
"assurance": "now",
|
||||
"expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
|
||||
"request": {
|
||||
"id": "attribute-list-stays-exact",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "synthetic-reviewer",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
|
||||
}
|
||||
},
|
||||
"action": "list",
|
||||
"resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
[
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"request": {
|
||||
"id": "attribute-non-human",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "not-a-person",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 1
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"request": {
|
||||
"id": "attribute-stale-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "test-human",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 1
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"request": {
|
||||
"id": "attribute-future-mfa",
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "test-human",
|
||||
"type": "human",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"assurance": {
|
||||
"level": "aal2",
|
||||
"mfa": true,
|
||||
"source": "key-cape",
|
||||
"methods": ["pwd", "otp"],
|
||||
"at": 9999999999
|
||||
}
|
||||
}
|
||||
},
|
||||
"action": "read",
|
||||
"resource": {
|
||||
"id": "memo:intake-new-memo",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"policy_version": "v8"
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
21
examples/informed-decision-lifecycle-review/fixtures.json
Normal file
21
examples/informed-decision-lifecycle-review/fixtures.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"request": {
|
||||
"id": "unknown",
|
||||
"subject": {
|
||||
"id": "unknown",
|
||||
"type": "human"
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:unrelated",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision"
|
||||
}
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"system:serviceaccount:state-hub:state-hub": {
|
||||
"submitter_id": "state-hub",
|
||||
"memo_classes": [
|
||||
"decision-record"
|
||||
],
|
||||
"review_groups": [
|
||||
"net-kingdom-admins"
|
||||
],
|
||||
"daily_limit": 50
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"memo_version": 3,
|
||||
"label": "t03-apply"
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"memo_version": 3,
|
||||
"label": "t03-verify"
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"memo_version": 3,
|
||||
"label": "t03-exec"
|
||||
}
|
||||
}
|
||||
5
examples/informed-decision-lifecycle-review/pin.json
Normal file
5
examples/informed-decision-lifecycle-review/pin.json
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"package": "informed-decision.compact-sitting",
|
||||
"version": "v12",
|
||||
"package_digest": "sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db"
|
||||
}
|
||||
708
examples/informed-decision-lifecycle-review/policy.md
Normal file
708
examples/informed-decision-lifecycle-review/policy.md
Normal file
|
|
@ -0,0 +1,708 @@
|
|||
---
|
||||
id: informed-decision.compact-sitting
|
||||
name: Compact sitting exact-record human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v12
|
||||
status: ready
|
||||
package: flexauth.informed_decision.compact_sitting
|
||||
allow_ttl: 30s
|
||||
actions: [read, acknowledge, accept, return, discuss, decline, list]
|
||||
owner: flex-auth
|
||||
fixtures: [fixtures.json, attribute_fixtures.json]
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
activation:
|
||||
mode: local
|
||||
---
|
||||
|
||||
# Lifecycle review release candidate
|
||||
|
||||
This v12 candidate retains the deployed v11 exact records and adds only
|
||||
State Hub / decision-record attribute admission for INFD-WP-0007. The unchanged
|
||||
sitting directory and deployed values remain the v11 rollback reference. New
|
||||
lifecycle decisions use this attribute branch without package regeneration.
|
||||
Review groups remain verified by the consumer and the subject identity.
|
||||
|
||||
# Compact sitting review mandate
|
||||
|
||||
This is a new exact-record package for seven 2026-09-14 sitting memos.
|
||||
v2 (2026-09-21) adds exactly one record, `memo:infd-20260921-b01` (the
|
||||
SECRETS-WP-0009-T03 spend envelope), with native pins from informed-decision
|
||||
`docs/evidence/2026-09-21-budget-approval-create.json`. The seven v1 records
|
||||
and the identity bar are unchanged.
|
||||
It is not an expansion of `examples/informed-decision-t03` / FLEX-WP-0027.
|
||||
`memo:infd-20260914-c01` is omitted (create-client still undecided).
|
||||
|
||||
v3 (2026-09-21, `FLEX-WP-0032`, `FLEX-DEC-2026-017`) adds one action, `list`,
|
||||
for informed-decision's decision overview (`INFD-IN-0008`). It is a separate
|
||||
rule, not an extra member of the act set, and it changes nothing else:
|
||||
|
||||
- `read` and the five acts keep the v2 rule unchanged — the same eight records,
|
||||
the same 900-second MFA window. A `list` allow satisfies no other action.
|
||||
- `list` covers the **union** of this package's eight records and the three
|
||||
`SECRETS-WP-0010-T03-*` records from `informed-decision.t03-review`, each
|
||||
pinned by approval id, binding digest and its own memo version (T03 at 3).
|
||||
Scope stays exact-record: a memo is listable only once someone admitted it.
|
||||
The operator declined resource-type-wide scope because the PDP checks no
|
||||
recipient, and a type-wide rule would have left consumer code — which the
|
||||
consumer itself says is not an entitlement — as the only scope.
|
||||
- `list` carries the same identity bar with a **12-hour** MFA window instead of
|
||||
900 seconds. Looking back at your own outcomes is not binding a new one. The
|
||||
bar is lighter, not absent: the PDP still states a bound.
|
||||
- The KeyCape stale-timestamp defect (`INFD-IN-0005`) is **not** worked around
|
||||
here. `read` stays strict; that defect is key-cape's to fix.
|
||||
|
||||
v4 (2026-09-27, REINAH-WP-0003-T06) adds exactly one record for the
|
||||
EUR 10 single-attempt tool proof. Native pins come from informed-decision
|
||||
`docs/evidence/2026-09-27-tool-budget-approval-create.json`. Existing records,
|
||||
actions and identity requirements remain unchanged.
|
||||
|
||||
v5 (2026-09-27, REINAH-WP-0003-T06) admits the replacement-window memo
|
||||
`memo:infd-20260927-b02` with fresh native pins. The accepted b01 record is
|
||||
preserved; this change does not extend its signed execution window.
|
||||
|
||||
v6 (2026-09-27, REINAH-WP-0003-T06) admits six exact native metered
|
||||
credential requests, apply/verify/exec per provider and worker lane. All acts
|
||||
still require the authenticated human and fresh MFA. Ordinary worker approvals
|
||||
retain their native control type and require exact-ID consumer configuration.
|
||||
|
||||
v7 (2026-10-03, INFD-WP-ADHOC-2026-10-03-T02) adds the exact
|
||||
`memo:infd-20261003-p01` delivery-proof acceptance record. Native pins come
|
||||
from informed-decision `docs/evidence/2026-10-03-provisioning-window-approval-create.json`.
|
||||
Existing records and identity requirements are preserved.
|
||||
|
||||
v8 (2026-10-03, offline attribute admission) adds one branch beside those
|
||||
exact-record rules. It is not the deployed sitting pin. Requests whose
|
||||
resource id is in `records` or `listable` still take only the exact-record
|
||||
rules, including when they also carry attribute fields, so an exact-record
|
||||
decision does not change. `list` stays on the exact-record rule.
|
||||
|
||||
The attribute branch may allow `read`, `acknowledge`, `accept`, `return`,
|
||||
`discuss` and `decline` for any other memo id. `attribute_eligible` is
|
||||
eligibility only. It checks that the carried approval id is a UUID and the
|
||||
carried digest matches `sha256:` plus 64 lowercase hex digits. It does not
|
||||
read an approval and it does not prove the memo pin. The effect owner still
|
||||
reads the approval live and compares that id and the engine's native digest
|
||||
with the memo. `approval_human_control` must be boolean true. No presentation
|
||||
hash is read. Context fields are `review_group`, `memo_class`,
|
||||
`intake_submitter`, `approval_requester`, `approval_human_control`,
|
||||
`memo_version`, `approval_id` and `approval_binding_digest`.
|
||||
|
||||
v9 (2026-10-04, EMERGENT-WP-0002 profile adoption) adds exactly one record,
|
||||
`memo:emergent-profile-adoption-0-2-6`. Native pins come from informed-decision
|
||||
`docs/evidence/2026-10-04-emergent-profile-approval-create.json`, approval
|
||||
`05751e09-3a5b-4a41-a4e8-b79e96de6484`. Existing exact records stay. The v8
|
||||
attribute branch remains beside them and still admits nobody, because the
|
||||
shipped submitter and class sets are empty.
|
||||
|
||||
v10 (2026-10-04, STATE-WP-0094 production-steps sitting) adds exactly four
|
||||
records: `memo:state-hub-edge-receiving-rollout-c287ed8`,
|
||||
`memo:owner-return-pickup-plan-b6222af`,
|
||||
`memo:freshness-runner-deploy-trial-e77f8b4` and
|
||||
`memo:freshness-schedule-enable-retire-sweep`. Native pins come from
|
||||
informed-decision `docs/evidence/2026-10-04-state-hub-wp0094-approval-create.json`,
|
||||
approvals `974eae4d-782d-41ed-93be-e34433b5fe59`,
|
||||
`77993081-1db2-4bba-99f2-74ca1f8652b1`, `4ae04c8e-d604-4d8b-b166-693eef855da8`
|
||||
and `b75752d1-bab6-4cf3-9308-5368c1d5aa91`. Existing exact records, including
|
||||
v9's, stay. The v8 attribute branch still admits nobody.
|
||||
|
||||
v11 (2026-10-04, IR-WP-0005-T02) lets the three `list_only_records` be
|
||||
reviewed. `read`, `acknowledge`, `accept`, `return`, `discuss` and
|
||||
`decline` allow when the memo id, memo version 3, approval id and binding
|
||||
digest match those records, with the same 900-second KeyCape bar as the
|
||||
version-1 act rule. `list` is unchanged. A version other than 3, a foreign
|
||||
approval id, or a different digest is refused. The version-1 `records` set
|
||||
is unchanged, and these three ids stay out of it.
|
||||
|
||||
`admitted_submitters` and `admitted_classes` are generated from
|
||||
informed-decision `deploy/intake-submitters.json`. The shipped registry is
|
||||
empty, so both sets are empty and this branch admits nobody. Regenerate with
|
||||
`python3 tools/gen_informed_decision_admission.py`; `--check` reports drift.
|
||||
|
||||
The identity bar matches T03: authenticated informed-decision caller,
|
||||
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
|
||||
memo content or presentation state. TokenReview must admit
|
||||
`system:serviceaccount:informed-decision:review` before this package is
|
||||
served. Membership tenant provenance may follow the accepted registration
|
||||
route; it does not assert directory membership in tenant:platform.
|
||||
Only a real human uses accept. This package neither issues nor consumes
|
||||
approval. Native pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
records := {
|
||||
"memo:state-hub-edge-receiving-rollout-c287ed8": {
|
||||
"approval_id": "974eae4d-782d-41ed-93be-e34433b5fe59",
|
||||
"binding_digest": "sha256:84735b88b2db20d9445af369e28a8d40bd495dd20c0303ff3a764666ec976dde"
|
||||
},
|
||||
"memo:owner-return-pickup-plan-b6222af": {
|
||||
"approval_id": "77993081-1db2-4bba-99f2-74ca1f8652b1",
|
||||
"binding_digest": "sha256:e745ef64658e77e41b2a5ef569ec0f6986e120d338656d75749425f5f29b7ca0"
|
||||
},
|
||||
"memo:freshness-runner-deploy-trial-e77f8b4": {
|
||||
"approval_id": "4ae04c8e-d604-4d8b-b166-693eef855da8",
|
||||
"binding_digest": "sha256:f8ff89dd353c1d2006622c45996c0f05f050865f8c203373dc74da1ba3f05e24"
|
||||
},
|
||||
"memo:freshness-schedule-enable-retire-sweep": {
|
||||
"approval_id": "b75752d1-bab6-4cf3-9308-5368c1d5aa91",
|
||||
"binding_digest": "sha256:cc3e8fe6ace5438f19d647d3de226407c8b009985c82ad9a993e81226e6f316f"
|
||||
},
|
||||
"memo:infd-20261003-p01": {
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
"memo:emergent-profile-adoption-0-2-6": {
|
||||
"approval_id": "05751e09-3a5b-4a41-a4e8-b79e96de6484",
|
||||
"binding_digest": "sha256:7843e660694dcd7c806dc02ee0cca05dd3a96488f614b1946291496259a02001"
|
||||
},
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
|
||||
},
|
||||
"memo:infd-20260921-b01": {
|
||||
"approval_id": "ba5ce2d8-8b6d-40be-af89-2e8c147029a3",
|
||||
"binding_digest": "sha256:e9eaf454e94871ec2060855fcfbd327bcaec873d2c61cae031bec9f95a34bcae"
|
||||
},
|
||||
"memo:infd-20260927-b01": {
|
||||
"approval_id": "e9521804-8fce-4fbc-bfdf-8a1aa959fd61",
|
||||
"binding_digest": "sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185"
|
||||
},
|
||||
"memo:infd-20260927-b02": {
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"memo:metered-20260927-provider-apply": {
|
||||
"approval_id": "0c05bd0a-f81f-451d-840c-5565628e2edc",
|
||||
"binding_digest": "sha256:a36b88244c26b1ffcd765cbadc201ff79260c7bcbd71d20d1584c3c0a3b1c3de"
|
||||
},
|
||||
"memo:metered-20260927-provider-verify": {
|
||||
"approval_id": "47f118a3-a86c-43ad-969d-42e09a0f45bb",
|
||||
"binding_digest": "sha256:98636335ccd36286c02fe018f296fd7d4dfd091ee89d27fe1b629e3db00cf121"
|
||||
},
|
||||
"memo:metered-20260927-provider-exec": {
|
||||
"approval_id": "7b32443a-a817-400c-a130-01b9ef04c8ee",
|
||||
"binding_digest": "sha256:8b31dd5911552b901b1f807a8cd6348d09547f3dbb2a52e3b42ad9fd948a2b01"
|
||||
},
|
||||
"memo:metered-20260927-worker-apply": {
|
||||
"approval_id": "2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"binding_digest": "sha256:412b79fb537d4444e52e3358820b6ea204fa17173a4420ab6372c52d010ee018"
|
||||
},
|
||||
"memo:metered-20260927-worker-verify": {
|
||||
"approval_id": "c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"binding_digest": "sha256:bce6e2091ed076ec0040804d24c822078ac1eda18cd62703801fc9da77898303"
|
||||
},
|
||||
"memo:metered-20260927-worker-exec": {
|
||||
"approval_id": "dc22666a-d5d7-46bc-9490-ebe9fe09dc38",
|
||||
"binding_digest": "sha256:ae261c9271a21b626be354646054f493d0951f69aecdbde3cfce3ac0c5667e8f"
|
||||
}
|
||||
}
|
||||
|
||||
list_only_records := {
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"memo_version": 3
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"memo_version": 3
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"memo_version": 3
|
||||
}
|
||||
}
|
||||
|
||||
# listable is the union list may range over. Sitting records are memo version 1.
|
||||
# T03 records carry memo version 3 and are acted on only through list_only_records.
|
||||
listable := object.union(
|
||||
{id: object.union(r, {"memo_version": 1}) | some id, r in records},
|
||||
list_only_records,
|
||||
)
|
||||
|
||||
# BEGIN GENERATED admitted_sets (tools/gen_informed_decision_admission.py; do not edit by hand)
|
||||
admitted_submitters := {
|
||||
"state-hub",
|
||||
}
|
||||
|
||||
admitted_classes := {
|
||||
"decision-record",
|
||||
}
|
||||
# END GENERATED admitted_sets
|
||||
|
||||
exact_id if {
|
||||
id := object.get(object.get(input, "resource", {}), "id", "")
|
||||
listable[id]
|
||||
}
|
||||
|
||||
attribute_attempt if {
|
||||
not exact_id
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
ctx := object.get(input, "context", {})
|
||||
some key in {"review_group", "memo_class", "intake_submitter", "approval_requester", "approval_human_control"}
|
||||
object.get(ctx, key, null) != null
|
||||
}
|
||||
|
||||
identity_core if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
}
|
||||
|
||||
mfa_fresh if {
|
||||
identity_core
|
||||
age := time.now_ns() / 1000000000 - input.subject.attributes.assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
}
|
||||
|
||||
stale_mfa if {
|
||||
identity_core
|
||||
age := time.now_ns() / 1000000000 - input.subject.attributes.assurance.at
|
||||
age > 900
|
||||
}
|
||||
|
||||
resource_ok if {
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
is_string(input.resource.id)
|
||||
regex.match(`^memo:[a-z0-9][a-z0-9-]{2,62}$`, input.resource.id)
|
||||
}
|
||||
|
||||
review_group_ok if {
|
||||
group := input.context.review_group
|
||||
is_string(group)
|
||||
group != ""
|
||||
group in input.subject.attributes.groups
|
||||
}
|
||||
|
||||
class_ok if {
|
||||
is_string(input.context.memo_class)
|
||||
input.context.memo_class in admitted_classes
|
||||
}
|
||||
|
||||
submitter_ok if {
|
||||
is_string(input.context.intake_submitter)
|
||||
input.context.intake_submitter in admitted_submitters
|
||||
}
|
||||
|
||||
requester_ok if {
|
||||
input.context.approval_requester == "informed-decision"
|
||||
}
|
||||
|
||||
human_control_ok if {
|
||||
input.context.approval_human_control == true
|
||||
}
|
||||
|
||||
approval_id_ok if {
|
||||
is_string(input.context.approval_id)
|
||||
regex.match(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`, input.context.approval_id)
|
||||
}
|
||||
|
||||
digest_ok if {
|
||||
is_string(input.context.approval_binding_digest)
|
||||
regex.match(`^sha256:[0-9a-f]{64}$`, input.context.approval_binding_digest)
|
||||
}
|
||||
|
||||
version_ok if {
|
||||
is_number(input.context.memo_version)
|
||||
input.context.memo_version >= 1
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
} else := {"effect": "allow", "reason": "operator_admitted_t03_review_act"} if {
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := list_only_records[input.resource.id]
|
||||
input.context.memo_version == record.memo_version
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
} else := {"effect": "allow", "reason": "operator_admitted_overview_list"} if {
|
||||
input.action == "list"
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 43200
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := listable[input.resource.id]
|
||||
input.context.memo_version == record.memo_version
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
} else := {"effect": "allow", "reason": "attribute_eligible"} if {
|
||||
attribute_attempt
|
||||
mfa_fresh
|
||||
resource_ok
|
||||
review_group_ok
|
||||
class_ok
|
||||
submitter_ok
|
||||
requester_ok
|
||||
human_control_ok
|
||||
approval_id_ok
|
||||
digest_ok
|
||||
version_ok
|
||||
} else := {"effect": "deny", "reason": "identity_refused"} if {
|
||||
attribute_attempt
|
||||
not identity_core
|
||||
} else := {"effect": "deny", "reason": "stale_mfa"} if {
|
||||
attribute_attempt
|
||||
stale_mfa
|
||||
} else := {"effect": "deny", "reason": "identity_refused"} if {
|
||||
attribute_attempt
|
||||
not mfa_fresh
|
||||
} else := {"effect": "deny", "reason": "resource_refused"} if {
|
||||
attribute_attempt
|
||||
not resource_ok
|
||||
} else := {"effect": "deny", "reason": "review_group_not_verified"} if {
|
||||
attribute_attempt
|
||||
not review_group_ok
|
||||
} else := {"effect": "deny", "reason": "unknown_class"} if {
|
||||
attribute_attempt
|
||||
not class_ok
|
||||
} else := {"effect": "deny", "reason": "unknown_submitter"} if {
|
||||
attribute_attempt
|
||||
not submitter_ok
|
||||
} else := {"effect": "deny", "reason": "requester_mismatch"} if {
|
||||
attribute_attempt
|
||||
not requester_ok
|
||||
} else := {"effect": "deny", "reason": "human_control_false"} if {
|
||||
attribute_attempt
|
||||
not human_control_ok
|
||||
} else := {"effect": "deny", "reason": "approval_id_malformed"} if {
|
||||
attribute_attempt
|
||||
not approval_id_ok
|
||||
} else := {"effect": "deny", "reason": "digest_mismatch"} if {
|
||||
attribute_attempt
|
||||
not digest_ok
|
||||
} else := {"effect": "deny", "reason": "memo_version_refused"} if {
|
||||
attribute_attempt
|
||||
not version_ok
|
||||
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
```
|
||||
|
||||
```rego test
|
||||
package flexauth.informed_decision.compact_sitting_test
|
||||
import rego.v1
|
||||
import data.flexauth.informed_decision.compact_sitting
|
||||
|
||||
test_unknown_request_denied if {
|
||||
compact_sitting.decision.effect == "deny" with input as {}
|
||||
}
|
||||
|
||||
test_listable_is_exact_union if {
|
||||
count(compact_sitting.listable) == count(compact_sitting.records) + count(compact_sitting.list_only_records)
|
||||
}
|
||||
|
||||
test_t03_records_not_in_act_scope if {
|
||||
every id, _ in compact_sitting.list_only_records {
|
||||
not compact_sitting.records[id]
|
||||
}
|
||||
}
|
||||
|
||||
tool_proof_input := {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {"id": "test-human", "type": "human", "tenant": "tenant:platform",
|
||||
"attributes": {"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied", "groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape",
|
||||
"methods": ["pwd", "otp"], "at": time.now_ns() / 1000000000}}},
|
||||
"resource": {"tenant": "tenant:platform", "system": "informed-decision",
|
||||
"type": "decision-memo", "id": "memo:infd-20260927-b02"},
|
||||
"action": "accept",
|
||||
"context": {"memo_version": 1,
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"},
|
||||
}
|
||||
|
||||
test_tool_proof_exact_record_allowed if {
|
||||
compact_sitting.decision.effect == "allow" with input as tool_proof_input
|
||||
}
|
||||
|
||||
test_tool_proof_wrong_native_id_denied if {
|
||||
compact_sitting.decision.effect == "deny" with input as tool_proof_input
|
||||
with input.context.approval_id as "another-approval"
|
||||
}
|
||||
|
||||
test_tool_proof_wrong_digest_denied if {
|
||||
compact_sitting.decision.effect == "deny" with input as tool_proof_input
|
||||
with input.context.approval_binding_digest as "sha256:wrong"
|
||||
}
|
||||
|
||||
test_tool_proof_without_mfa_denied if {
|
||||
compact_sitting.decision.effect == "deny" with input as tool_proof_input
|
||||
with input.subject.attributes.assurance.mfa as false
|
||||
}
|
||||
|
||||
|
||||
test_six_exact_metered_memos_allow_human_review if {
|
||||
every id in ["memo:metered-20260927-provider-apply", "memo:metered-20260927-provider-verify", "memo:metered-20260927-provider-exec", "memo:metered-20260927-worker-apply", "memo:metered-20260927-worker-verify", "memo:metered-20260927-worker-exec"] {
|
||||
record := compact_sitting.records[id]
|
||||
request := object.union(tool_proof_input, {
|
||||
"resource": object.union(tool_proof_input.resource, {"id": id}),
|
||||
"context": {"memo_version": 1, "approval_id": record.approval_id,
|
||||
"approval_binding_digest": record.binding_digest},
|
||||
})
|
||||
compact_sitting.decision.effect == "allow" with input as request
|
||||
}
|
||||
}
|
||||
|
||||
attribute_input := {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {"id": "test-human", "type": "human", "tenant": "tenant:platform",
|
||||
"attributes": {"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied", "groups": ["net-kingdom-admins"],
|
||||
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape",
|
||||
"methods": ["pwd", "otp"], "at": time.now_ns() / 1000000000}}},
|
||||
"resource": {"tenant": "tenant:platform", "system": "informed-decision",
|
||||
"type": "decision-memo", "id": "memo:intake-new-memo"},
|
||||
"action": "accept",
|
||||
"context": {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"memo_version": 1,
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
||||
},
|
||||
}
|
||||
|
||||
patched_context(req, patch) := object.union(req, {"context": object.union(req.context, patch)})
|
||||
|
||||
with_at(req, at) := object.union(req, {"subject": object.union(req.subject, {"attributes": object.union(req.subject.attributes, {"assurance": object.union(req.subject.attributes.assurance, {"at": at})})})})
|
||||
|
||||
eligible(req) := result if {
|
||||
result := compact_sitting.decision with input as req
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_classes as {"credential-lane"}
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_submitters as {"state-hub"}
|
||||
}
|
||||
|
||||
classes_only(req) := result if {
|
||||
result := compact_sitting.decision with input as req
|
||||
with data.flexauth.informed_decision.compact_sitting.admitted_classes as {"credential-lane"}
|
||||
}
|
||||
|
||||
test_initial_release_sets if {
|
||||
compact_sitting.admitted_classes == {"decision-record"}
|
||||
compact_sitting.admitted_submitters == {"state-hub"}
|
||||
compact_sitting.decision.reason == "unknown_class" with input as attribute_input
|
||||
}
|
||||
|
||||
test_initial_release_allows_only_decision_record_class if {
|
||||
every action in ["read", "acknowledge", "accept", "return", "discuss", "decline"] {
|
||||
req := object.union(patched_context(attribute_input, {"memo_class": "decision-record"}), {"action": action})
|
||||
compact_sitting.decision.reason == "attribute_eligible" with input as req
|
||||
}
|
||||
}
|
||||
|
||||
test_attribute_acts_are_eligible_only_when_sets_admit if {
|
||||
every action in ["read", "acknowledge", "accept", "return", "discuss", "decline"] {
|
||||
eligible(object.union(attribute_input, {"action": action})).reason == "attribute_eligible"
|
||||
}
|
||||
}
|
||||
|
||||
test_allow_does_not_prove_the_pin if {
|
||||
other := "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
||||
attribute_input.context.approval_binding_digest != other
|
||||
eligible(attribute_input).reason == "attribute_eligible"
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": other})).reason == "attribute_eligible"
|
||||
}
|
||||
|
||||
test_unknown_class if {
|
||||
eligible(patched_context(attribute_input, {"memo_class": "not-a-class"})).reason == "unknown_class"
|
||||
}
|
||||
|
||||
test_unknown_submitter if {
|
||||
classes_only(patched_context(attribute_input, {"intake_submitter": "unknown"})).reason == "unknown_submitter"
|
||||
}
|
||||
|
||||
test_requester_mismatch if {
|
||||
eligible(patched_context(attribute_input, {"approval_requester": "other-service"})).reason == "requester_mismatch"
|
||||
}
|
||||
|
||||
test_human_control_false if {
|
||||
eligible(patched_context(attribute_input, {"approval_human_control": false})).reason == "human_control_false"
|
||||
eligible(patched_context(attribute_input, {"approval_human_control": "true"})).reason == "human_control_false"
|
||||
}
|
||||
|
||||
test_digest_mismatch if {
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": "sha256:wrong"})).reason == "digest_mismatch"
|
||||
eligible(patched_context(attribute_input, {"approval_binding_digest": "sha256:C8A1A9C8FB22616E3AACFB877BA7974FEB5EEDAED491F856A6C90719C502EBE4"})).reason == "digest_mismatch"
|
||||
}
|
||||
|
||||
test_approval_id_malformed if {
|
||||
eligible(patched_context(attribute_input, {"approval_id": "not-a-uuid"})).reason == "approval_id_malformed"
|
||||
}
|
||||
|
||||
test_memo_version_refused if {
|
||||
eligible(patched_context(attribute_input, {"memo_version": 0})).reason == "memo_version_refused"
|
||||
}
|
||||
|
||||
test_stale_mfa_on_attribute_branch if {
|
||||
eligible(with_at(attribute_input, time.now_ns() / 1000000000 - 901)).reason == "stale_mfa"
|
||||
}
|
||||
|
||||
test_future_mfa_is_identity_refused if {
|
||||
eligible(with_at(attribute_input, time.now_ns() / 1000000000 + 300)).reason == "identity_refused"
|
||||
}
|
||||
|
||||
test_service_subject_is_identity_refused if {
|
||||
eligible(object.union(attribute_input, {"subject": object.union(attribute_input.subject, {"type": "service"})})).reason == "identity_refused"
|
||||
}
|
||||
|
||||
test_review_group_must_be_verified if {
|
||||
req := object.union(attribute_input, {"subject": object.union(attribute_input.subject, {"attributes": object.union(attribute_input.subject.attributes, {"groups": ["other-group"]})})})
|
||||
eligible(req).reason == "review_group_not_verified"
|
||||
}
|
||||
|
||||
test_memo_review_group_is_not_hardcoded if {
|
||||
req := object.union(attribute_input, {
|
||||
"subject": object.union(attribute_input.subject, {"attributes": object.union(attribute_input.subject.attributes, {"groups": ["cabinet-reviewers"]})}),
|
||||
"context": object.union(attribute_input.context, {"review_group": "cabinet-reviewers"}),
|
||||
})
|
||||
eligible(req).reason == "attribute_eligible"
|
||||
}
|
||||
|
||||
test_bad_memo_id_refused if {
|
||||
eligible(object.union(attribute_input, {"resource": object.union(attribute_input.resource, {"id": "memo:NO"})})).reason == "resource_refused"
|
||||
}
|
||||
|
||||
test_list_does_not_use_attribute_admission if {
|
||||
got := eligible(object.union(attribute_input, {"action": "list"}))
|
||||
got.effect == "deny"
|
||||
got.reason == "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
|
||||
test_exact_record_ignores_attribute_context if {
|
||||
req := object.union(tool_proof_input, {"context": object.union(tool_proof_input.context, {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"view_hash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
|
||||
})})
|
||||
got := compact_sitting.decision with input as req
|
||||
got.effect == "allow"
|
||||
got.reason == "operator_admitted_compact_sitting"
|
||||
}
|
||||
|
||||
test_exact_pin_mismatch_is_not_rescued if {
|
||||
req := object.union(tool_proof_input, {"context": object.union(tool_proof_input.context, {
|
||||
"review_group": "net-kingdom-admins",
|
||||
"memo_class": "credential-lane",
|
||||
"intake_submitter": "state-hub",
|
||||
"approval_requester": "informed-decision",
|
||||
"approval_human_control": true,
|
||||
"approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
})})
|
||||
got := eligible(req)
|
||||
got.effect == "deny"
|
||||
got.reason == "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
|
||||
```
|
||||
444
examples/informed-decision-lifecycle-review/records.json
Normal file
444
examples/informed-decision-lifecycle-review/records.json
Normal file
|
|
@ -0,0 +1,444 @@
|
|||
{
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
|
||||
"label": "c02",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "railiance-platform",
|
||||
"purpose": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane",
|
||||
"target": {
|
||||
"id": "rpf-wp-0035-t02",
|
||||
"type": "credential-lane",
|
||||
"system": "railiance-platform"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
|
||||
"label": "c03",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "informed-decision",
|
||||
"principal": "netkingdom",
|
||||
"purpose": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback",
|
||||
"target": {
|
||||
"id": "nk-wp-0032-t03",
|
||||
"type": "openbao-role",
|
||||
"system": "netkingdom"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
|
||||
"label": "c04",
|
||||
"binding": {
|
||||
"action": "attend",
|
||||
"actor": "informed-decision",
|
||||
"principal": "ops-warden",
|
||||
"purpose": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work",
|
||||
"target": {
|
||||
"id": "warden-wp-0027-t02",
|
||||
"type": "trust-root",
|
||||
"system": "ops-warden"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
|
||||
"label": "d01",
|
||||
"binding": {
|
||||
"action": "retire",
|
||||
"actor": "informed-decision",
|
||||
"principal": "the-custodian",
|
||||
"purpose": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback",
|
||||
"target": {
|
||||
"id": "cust-wp-0038-t08",
|
||||
"type": "operating-model",
|
||||
"system": "the-custodian"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
|
||||
"label": "d02",
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path",
|
||||
"target": {
|
||||
"id": "ccr-2026-0019",
|
||||
"type": "ccr",
|
||||
"system": "helixforge-factory"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
|
||||
"label": "d03",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "mason",
|
||||
"purpose": "Accept the fluid-telegram operator credential lane plan so construction may proceed",
|
||||
"target": {
|
||||
"id": "mason-wp-0005",
|
||||
"type": "workplan",
|
||||
"system": "mason"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
|
||||
"label": "d04",
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"principal": "railiance-clock",
|
||||
"purpose": "Confirm ecosystem ownership and the security role for Railiance Clock as specified",
|
||||
"target": {
|
||||
"id": "rclk-wp-0002-t01",
|
||||
"type": "workplan",
|
||||
"system": "railiance-clock"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260921-b01": {
|
||||
"approval_id": "ba5ce2d8-8b6d-40be-af89-2e8c147029a3",
|
||||
"binding_digest": "sha256:e9eaf454e94871ec2060855fcfbd327bcaec873d2c61cae031bec9f95a34bcae",
|
||||
"label": "b01",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Accept the spend envelope for metered Glas runs on the Anthropic key",
|
||||
"target": {
|
||||
"id": "spend-envelope:hfact-glas-anthropic-2026-09",
|
||||
"type": "spend-envelope",
|
||||
"system": "rein-aharness"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260927-b01": {
|
||||
"approval_id": "e9521804-8fce-4fbc-bfdf-8a1aa959fd61",
|
||||
"binding_digest": "sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185",
|
||||
"label": "20260927-b01",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Accept one EUR 10 metered tool proof; no retry or publication; 2026-09-27T16:35:00Z through 2026-09-27T17:35:00Z",
|
||||
"target": {
|
||||
"id": "spend-envelope:hfact-glas-tool-proof-20260927-one-attempt",
|
||||
"system": "rein-aharness",
|
||||
"type": "spend-envelope"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260927-b02": {
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773",
|
||||
"label": "20260927-b02",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Accept one EUR 10 metered tool proof; no retry or publication; 2026-09-27T18:20:00Z through 2026-09-28T18:20:00Z",
|
||||
"target": {
|
||||
"id": "spend-envelope:hfact-glas-tool-proof-20260927-renewed-one-attempt",
|
||||
"system": "rein-aharness",
|
||||
"type": "spend-envelope"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-apply": {
|
||||
"approval_id": "0c05bd0a-f81f-451d-840c-5565628e2edc",
|
||||
"binding_digest": "sha256:a36b88244c26b1ffcd765cbadc201ff79260c7bcbd71d20d1584c3c0a3b1c3de",
|
||||
"label": "metered-20260927-provider-apply",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-verify": {
|
||||
"approval_id": "47f118a3-a86c-43ad-969d-42e09a0f45bb",
|
||||
"binding_digest": "sha256:98636335ccd36286c02fe018f296fd7d4dfd091ee89d27fe1b629e3db00cf121",
|
||||
"label": "metered-20260927-provider-verify",
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-exec": {
|
||||
"approval_id": "7b32443a-a817-400c-a130-01b9ef04c8ee",
|
||||
"binding_digest": "sha256:8b31dd5911552b901b1f807a8cd6348d09547f3dbb2a52e3b42ad9fd948a2b01",
|
||||
"label": "metered-20260927-provider-exec",
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-apply": {
|
||||
"approval_id": "2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"binding_digest": "sha256:412b79fb537d4444e52e3358820b6ea204fa17173a4420ab6372c52d010ee018",
|
||||
"label": "metered-20260927-worker-apply",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-verify": {
|
||||
"approval_id": "c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"binding_digest": "sha256:bce6e2091ed076ec0040804d24c822078ac1eda18cd62703801fc9da77898303",
|
||||
"label": "metered-20260927-worker-verify",
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-exec": {
|
||||
"approval_id": "dc22666a-d5d7-46bc-9490-ebe9fe09dc38",
|
||||
"binding_digest": "sha256:ae261c9271a21b626be354646054f493d0951f69aecdbde3cfce3ac0c5667e8f",
|
||||
"label": "metered-20260927-worker-exec",
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:emergent-profile-adoption-0-2-6": {
|
||||
"approval_id": "05751e09-3a5b-4a41-a4e8-b79e96de6484",
|
||||
"binding_digest": "sha256:7843e660694dcd7c806dc02ee0cca05dd3a96488f614b1946291496259a02001",
|
||||
"label": "emergent-profile-0-2-6",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "emergent-security",
|
||||
"purpose": "Accept only the non-normative knowledge profile boundary",
|
||||
"target": {
|
||||
"id": "emergent-security:knowledge:0.2.6:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"type": "knowledge-profile",
|
||||
"system": "emergent-security"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20261003-p01": {
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
|
||||
"label": "p01",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "railiance-platform",
|
||||
"purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
|
||||
"target": {
|
||||
"id": "ccr:CCR-2026-0019-delivery-proof",
|
||||
"type": "credential-lane",
|
||||
"system": "railiance-platform"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:state-hub-edge-receiving-rollout-c287ed8": {
|
||||
"approval_id": "974eae4d-782d-41ed-93be-e34433b5fe59",
|
||||
"binding_digest": "sha256:84735b88b2db20d9445af369e28a8d40bd495dd20c0303ff3a764666ec976dde",
|
||||
"label": "wp0094-m1-state-hub-c287ed8",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "state-hub",
|
||||
"purpose": "Production rollout of tested source; rollback is helm rollback to revision 72 without schema downgrade.",
|
||||
"target": {
|
||||
"id": "state-hub:source:c287ed82594313394ca8e67ce40714c90e744af6",
|
||||
"system": "state-hub",
|
||||
"type": "service-release"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:owner-return-pickup-plan-b6222af": {
|
||||
"approval_id": "77993081-1db2-4bba-99f2-74ca1f8652b1",
|
||||
"binding_digest": "sha256:e745ef64658e77e41b2a5ef569ec0f6986e120d338656d75749425f5f29b7ca0",
|
||||
"label": "wp0094-m2-owner-return-b6222af",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "activity-core",
|
||||
"purpose": "Plan approval plus a gated single-repo trial; the definition stays disabled and wakeups never clear waits.",
|
||||
"target": {
|
||||
"id": "activity-core:source:b6222af2cfd1094360a0d430e3907e8788a3acf9:owner-return-pickup",
|
||||
"system": "activity-core",
|
||||
"type": "activity-plan"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:freshness-runner-deploy-trial-e77f8b4": {
|
||||
"approval_id": "4ae04c8e-d604-4d8b-b166-693eef855da8",
|
||||
"binding_digest": "sha256:f8ff89dd353c1d2006622c45996c0f05f050865f8c203373dc74da1ba3f05e24",
|
||||
"label": "wp0094-m3-freshness-runner-e77f8b4",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "repo-manager",
|
||||
"purpose": "Deployment and limited data-writing trials; no schedule.",
|
||||
"target": {
|
||||
"id": "repo-manager:source:e77f8b457647ff23697e45a74615edde5f42d39d",
|
||||
"system": "repo-manager",
|
||||
"type": "service-release"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:freshness-schedule-enable-retire-sweep": {
|
||||
"approval_id": "b75752d1-bab6-4cf3-9308-5368c1d5aa91",
|
||||
"binding_digest": "sha256:cc3e8fe6ace5438f19d647d3de226407c8b009985c82ad9a993e81226e6f316f",
|
||||
"label": "wp0094-m4-freshness-schedule",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "activity-core",
|
||||
"purpose": "Recurring schedule activation after clean trials, and permanent retirement of the legacy sweep.",
|
||||
"target": {
|
||||
"id": "activity-core:definition:repo-manager-bounded-freshness:b2c6c5613218dea9dbaef303aff22a8d1b07f074",
|
||||
"system": "activity-core",
|
||||
"type": "activity-schedule"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
}
|
||||
}
|
||||
17
examples/informed-decision-lifecycle-review/registry.json
Normal file
17
examples/informed-decision-lifecycle-review/registry.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"subjects": [
|
||||
{
|
||||
"id": "sitting-reviewer",
|
||||
"type": "Human",
|
||||
"display_name": "Compact sitting reviewer",
|
||||
"organization_relation": "ServiceProvider",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"claims": {
|
||||
"assurance": "aal2",
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied"
|
||||
}
|
||||
}
|
||||
],
|
||||
"resources": []
|
||||
}
|
||||
21
examples/informed-decision-lifecycle/fixtures.json
Normal file
21
examples/informed-decision-lifecycle/fixtures.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"request": {
|
||||
"id": "unknown",
|
||||
"subject": {
|
||||
"id": "unknown",
|
||||
"type": "human"
|
||||
},
|
||||
"action": "lifecycle.register",
|
||||
"resource": {
|
||||
"id": "memo:unknown",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision"
|
||||
}
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny"
|
||||
}
|
||||
}
|
||||
]
|
||||
5
examples/informed-decision-lifecycle/pin.json
Normal file
5
examples/informed-decision-lifecycle/pin.json
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"package": "informed-decision.lifecycle",
|
||||
"version": "v1",
|
||||
"package_digest": "sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827"
|
||||
}
|
||||
186
examples/informed-decision-lifecycle/policy.md
Normal file
186
examples/informed-decision-lifecycle/policy.md
Normal file
|
|
@ -0,0 +1,186 @@
|
|||
---
|
||||
id: informed-decision.lifecycle
|
||||
name: Decision lifecycle authoring and collaboration
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v1
|
||||
status: ready
|
||||
package: flexauth.informed_decision.lifecycle
|
||||
allow_ttl: 30s
|
||||
actions: [lifecycle.register, lifecycle.read, lifecycle.search, lifecycle.revise, lifecycle.source, lifecycle.evaluation, lifecycle.comment, lifecycle.events, lifecycle.packet, lifecycle.publish, lifecycle.request_review, lifecycle.outcomes]
|
||||
owner: flex-auth
|
||||
fixtures: [fixtures.json]
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
activation:
|
||||
mode: local
|
||||
---
|
||||
|
||||
# Initial lifecycle audience
|
||||
|
||||
Founder direction, 2026-10-04, INFD-WP-0007: net-kingdom-admins humans and
|
||||
system:serviceaccount:state-hub:state-hub. This package is evaluated by Access
|
||||
Engine; the consumer supplies authenticated identity and immutable record facts.
|
||||
The evaluator's workload caller remains informed-decision/review, audience
|
||||
flex-auth. The State Hub subject is authenticated separately for audience
|
||||
informed-decision-lifecycle using CA-verified TokenReview, never a browser token.
|
||||
|
||||
Humans require KeyCape AAL2 MFA within 12 hours for authoring. Actual human binding
|
||||
retains the separate review policy's 900-second MFA requirement. This package
|
||||
has no accept action. An initial caller can register and search; record access
|
||||
requires original authorship or an explicit publication audience. Published
|
||||
collaborators may research, discuss and refine. Publication and requesting review
|
||||
require original authorship or an admitted human collaborator. Publication may
|
||||
name only the initial human group; explicit subjects still require admitted
|
||||
identity. Review routing is fixed to State Hub, decision-record class and
|
||||
net-kingdom-admins. Every operation is fresh; neither content nor evaluation
|
||||
assertions confer permission. Command digests correlate commands, not signatures.
|
||||
No presentation/view hash enters this policy.
|
||||
|
||||
The sibling registry declares identity contract profiles, following the existing
|
||||
review packages. These are not real human or workload identifiers and mint no
|
||||
identity. Authentication-derived values still come from the enforced consumer
|
||||
boundary (KeyCape sessions or CA-verified TokenReview). This remains a consumer
|
||||
claim trust boundary; a registry declaration is not independent verification.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
common if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == input.tenant
|
||||
input.resource.tenant == input.tenant
|
||||
input.resource.system == "informed-decision"
|
||||
input.context.contract == "informed-decision.lifecycle.v1"
|
||||
regex.match("^sha256:[0-9a-f]{64}$", input.context.command_digest)
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
}
|
||||
|
||||
human if {
|
||||
input.subject.type == "human"
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
age := time.now_ns()/1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 43200
|
||||
}
|
||||
|
||||
workload if {
|
||||
input.subject.type == "service"
|
||||
input.subject.id == "system:serviceaccount:state-hub:state-hub"
|
||||
input.subject.attributes.authentication_audience == "informed-decision-lifecycle"
|
||||
is_string(input.subject.attributes.workload_uid)
|
||||
input.subject.attributes.workload_uid != ""
|
||||
}
|
||||
|
||||
identity if human
|
||||
identity if workload
|
||||
|
||||
memo_resource if {
|
||||
input.resource.type == "decision-memo"
|
||||
regex.match("^memo:[A-Za-z0-9._:-]{1,256}$", input.resource.id)
|
||||
}
|
||||
|
||||
owner if {
|
||||
input.context.record.registered == true
|
||||
some author in [input.context.record.registered_by, input.context.record.revision_by]
|
||||
author.sub == input.subject.id
|
||||
author.kind == "person"
|
||||
human
|
||||
}
|
||||
owner if {
|
||||
input.context.record.registered == true
|
||||
some author in [input.context.record.registered_by, input.context.record.revision_by]
|
||||
author.sub == input.subject.id
|
||||
author.kind == "service"
|
||||
workload
|
||||
}
|
||||
|
||||
readable if owner
|
||||
readable if {
|
||||
input.context.record.registered == true
|
||||
input.subject.id in input.context.record.published_audience.subjects
|
||||
}
|
||||
readable if {
|
||||
human
|
||||
"net-kingdom-admins" in input.context.record.published_audience.groups
|
||||
}
|
||||
|
||||
may_publish if owner
|
||||
may_publish if {
|
||||
human
|
||||
readable
|
||||
}
|
||||
|
||||
audience_ok if {
|
||||
a := input.context.publication_audience
|
||||
is_array(a.subjects)
|
||||
is_array(a.groups)
|
||||
count(a.subjects) <= 32
|
||||
count(a.groups) <= 32
|
||||
count(a.subjects)+count(a.groups) > 0
|
||||
every group in a.groups { group == "net-kingdom-admins" }
|
||||
every subject in a.subjects { is_string(subject); subject != ""; subject != "*" }
|
||||
}
|
||||
|
||||
operation if {
|
||||
input.action == "lifecycle.register"
|
||||
memo_resource
|
||||
not input.context.record.registered
|
||||
input.context.memo_version == 1
|
||||
}
|
||||
operation if {
|
||||
input.action == "lifecycle.register"
|
||||
memo_resource
|
||||
owner
|
||||
input.context.memo_version == 1
|
||||
}
|
||||
operation if {
|
||||
input.action == "lifecycle.search"
|
||||
input.resource.type == "decision-collection"
|
||||
input.resource.id == "decisions"
|
||||
}
|
||||
operation if {
|
||||
input.action in {"lifecycle.read", "lifecycle.events", "lifecycle.packet", "lifecycle.outcomes",
|
||||
"lifecycle.revise", "lifecycle.source", "lifecycle.evaluation", "lifecycle.comment"}
|
||||
memo_resource
|
||||
readable
|
||||
}
|
||||
operation if {
|
||||
input.action == "lifecycle.publish"
|
||||
memo_resource
|
||||
may_publish
|
||||
audience_ok
|
||||
}
|
||||
operation if {
|
||||
input.action == "lifecycle.request_review"
|
||||
memo_resource
|
||||
may_publish
|
||||
routing := input.context.review_routing
|
||||
routing.submitter == "state-hub"
|
||||
routing.memo_class == "decision-record"
|
||||
routing.review_group == "net-kingdom-admins"
|
||||
}
|
||||
|
||||
decision := {"effect":"allow", "reason":"lifecycle_collaboration"} if {
|
||||
common
|
||||
identity
|
||||
operation
|
||||
} else := {"effect":"deny", "reason":"lifecycle_scope_or_identity_refused"}
|
||||
```
|
||||
|
||||
```rego test
|
||||
package flexauth.informed_decision.lifecycle_test
|
||||
import rego.v1
|
||||
import data.flexauth.informed_decision.lifecycle
|
||||
|
||||
test_empty_denied if {
|
||||
lifecycle.decision.effect == "deny" with input as {}
|
||||
}
|
||||
```
|
||||
29
examples/informed-decision-lifecycle/registry.json
Normal file
29
examples/informed-decision-lifecycle/registry.json
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"subjects": [
|
||||
{
|
||||
"id": "lifecycle-human-profile",
|
||||
"type": "Human",
|
||||
"display_name": "Human identity contract profile",
|
||||
"groups": [
|
||||
"net-kingdom-admins"
|
||||
],
|
||||
"claims": {
|
||||
"assurance": "aal2",
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "lifecycle-workload-profile",
|
||||
"type": "Service",
|
||||
"display_name": "TokenReview identity contract profile",
|
||||
"claims": {
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied",
|
||||
"authentication_audience": "informed-decision-lifecycle",
|
||||
"workload_uid": "TokenReview response UID"
|
||||
}
|
||||
}
|
||||
],
|
||||
"resources": []
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue