access-engine/workplans/FLEX-WP-0035-per-identity-application-readback.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related
FLEX-WP-0035	workplan	Per-identity application access readback and readable protected-system registry for user-engine	infotech	access-engine	proposed	claude	netkingdom	2026-10-09	2026-10-09	USER-WP-0026 USER-WP-0028

user-engine (message f1637c32, 2026-10-09, routed by net-kingdom 19a0cbcd) needs to show a signed-in person which applications they can use. Its USER-WP-0026-T03 and USER-WP-0028-T02 are blocked_on access-engine. The PEP stance is already fail-closed: no decision renders unavailable, and allow is never inferred from membership, platform role, registration, or a missing record.

What exists today (2026-10-09 review)

• POST /v1/batch_check takes several resources in one call and returns one decision per resource, each with a lifetime (expires_at) per the decision envelope. Shape-wise this is close to request (1).
• Caller auth authorizes the caller token against every resource.system in the batch (cmd/flex-auth/main.go, /v1/batch_check). The flex-auth-user-engine caller is bound to its own protected system, so a readback across other systems is a 403 today. That is correct behaviour for enforcement, and the reason this needs design rather than a config change.
• There is no generic "may use this application" action. Each package has its own action vocabulary, so "access to system X" has no defined meaning yet.
• There is no registry read endpoint. The protected-system registry is loaded from files and never served.

Define the readback contract

id: FLEX-WP-0035-T01
status: todo
priority: high

Decide the action that a readback evaluates per system: a declared application.access action each consumer package must opt into, versus a per-system mapping held in the registry. A system that declares nothing is returned as not_applicable, never allow. State per input class the revocation-visibility deadline the readback carries (§9.7). Decide whether the readback is a decision for audit purposes (decision record, emission) or an explicitly non-enforcing advisory read. A displayed allow must not be usable as a PEP decision by another system.

Gate: written contract in docs/ plus an ADR or decision record; reviewed with user-engine before code.

Caller authorization for cross-system readback

id: FLEX-WP-0035-T02
status: todo
priority: high
depends_on: [FLEX-WP-0035-T01]

Add a distinct caller capability (readback scope) instead of widening the flex-auth-user-engine binding to other systems' check rights. The readback caller must not be able to obtain a decision that another system's PEP would accept, and its decisions must say so in the binding.

Gate: tests prove a readback-scoped token gets 403 on /v1/check for a foreign system and is admitted only on the readback route.

Readable protected-system registry

id: FLEX-WP-0035-T03
status: todo
priority: medium
depends_on: [FLEX-WP-0035-T01]

Serve a read-only projection: system id, display name, key-cape client binding. Include the registry-snapshot digest so the catalogue is tied to the same snapshot that decisions record (G1, FLEX-WP-0019). Grants and revocations stay inside access-engine; user-domain admins get no grant surface from this work.

Gate: endpoint plus schema, admitted only for the readback caller, tests.

Deploy to the user-engine pin

id: FLEX-WP-0035-T04
status: wait
needs_human: true
depends_on: [FLEX-WP-0035-T02, FLEX-WP-0035-T03]
blocking_reason: "Live pin change on railiance01 needs founder go."
priority: medium

Roll the readback route and its caller binding onto flex-auth-user-engine, then hand user-engine the evidence that unblocks USER-WP-0026-T03.