coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/examples/application-readback/README.md
tegwick b5da745063
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m5s
Details
FLEX-WP-0035-T05: informed-decision lifecycle v2 declares application.access 
- application.access allows only with purpose=readback and the authoring
  human bar; no workload path, no audience or client-scoped claims
- v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04
- examples/application-readback: readback catalogue with informed-decision's
  key-cape client binding; integration test over the shipped files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
2026-10-09 20:10:50 +02:00

863 B
Raw Blame History

Application access readback catalogue

The readback pin's own registry (FLEX-WP-0035, FLEX-DEC-2026-019). It holds one entry per application that user-engine may list: id, display name, and the key-cape client its users sign in through. The entries are descriptive only and never decide an allow. Allow comes from each application's own package, which must declare application.access.

Participants' registries are loaded alongside this one, and their packages are loaded at the same files their own pins run:

System Package Registry
informed-decision examples/informed-decision-lifecycle/policy.md (v2) examples/informed-decision-lifecycle/registry.json

client_binding sources: informed-decision/docs/keycape-client-registration.md (client_id) and informed-decision/informed_decision/oidc.py (issuer).