tegwick
2de0f862f9
v14 (proposed, sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde) keeps every v13 decision and admits approval requester service:nk-bind-executor only from submitter nk-bind-executor, memo class and approval action bounded-execution, an aal2 human reviewer, and never the approval actor itself (GH-DEC-2026-026 class C2). v13 stays unchanged as rollback reference. The admission generator skips present_existing registry rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
140 lines
4.1 KiB
JSON
140 lines
4.1 KiB
JSON
[
|
|
{
|
|
"id": "attribute-non-human-refused",
|
|
"request": {
|
|
"id": "attribute-non-human",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "not-a-person",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 1
|
|
}
|
|
}
|
|
},
|
|
"action": "accept",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "identity_refused"
|
|
}
|
|
},
|
|
{
|
|
"id": "attribute-stale-mfa",
|
|
"request": {
|
|
"id": "attribute-stale-mfa",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "test-human",
|
|
"type": "human",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 1
|
|
}
|
|
}
|
|
},
|
|
"action": "accept",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "stale_mfa"
|
|
}
|
|
},
|
|
{
|
|
"id": "attribute-future-mfa",
|
|
"request": {
|
|
"id": "attribute-future-mfa",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "test-human",
|
|
"type": "human",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"principal_type_source": "authentication-derived",
|
|
"tenant_source": "registration-supplied",
|
|
"groups": ["net-kingdom-admins"],
|
|
"assurance": {
|
|
"level": "aal2",
|
|
"mfa": true,
|
|
"source": "key-cape",
|
|
"methods": ["pwd", "otp"],
|
|
"at": 9999999999
|
|
}
|
|
}
|
|
},
|
|
"action": "read",
|
|
"resource": {
|
|
"id": "memo:intake-new-memo",
|
|
"type": "decision-memo",
|
|
"system": "informed-decision",
|
|
"tenant": "tenant:platform"
|
|
},
|
|
"context": {
|
|
"review_group": "net-kingdom-admins",
|
|
"memo_class": "credential-lane",
|
|
"intake_submitter": "state-hub",
|
|
"approval_requester": "informed-decision",
|
|
"approval_human_control": true,
|
|
"memo_version": 1,
|
|
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
|
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
|
|
},
|
|
"policy_version": "v8"
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "identity_refused"
|
|
}
|
|
}
|
|
]
|