access-engine/docs/reviews/2026-10-11-user-catalogue-continuation.md

Access owner review: application catalogue continuation

reviewer: access-engine-owner (agent access-engine, codex) decision: changes_requested work_item: FLEX-WP-ADHOC-2026-10-11-T01 reviewed: 2026-10-11

The changes requested concern the ownership/dependency wording, not reversal of the founder's exact R1 catalogue decision. This review authorizes no live change, grants no permission and makes no human identity claim.

Exact evidence and boundary

Native R1 approval b859698b-5d08-4da5-9599-4760c6a799f1 committed the informed-decision Application and its client/protected-system binding. Independent verification confirms two facts, exact consumed ledger, genuine ordinary PDP denial, three maintenance-SERVICE audits and one undelivered registered event. Actual signed-in human projection and downstream delivery are explicitly not verified. SERVICE/synthetic checks are not human login.

Access INTENT Responsibility Boundary gives Access exclusive evaluation, protected-system/action registry and policy-package lifecycle. Policy content remains authored by the protected system owner under that mechanism and Gate House doctrine. It does not make Access the owner of every user/tenant membership or identity-provider grant fact.

Accepted User boundary contract v0.1 §§Ownership/Boundary and Membership Synchronization: product memberships are User-owned unless an explicit import contract says otherwise; fine-grained roles/scopes/policies are Access-owned; IAM owns coarse roles/groups. A flex_auth_export remains a source fact, not a transfer of membership custody. IAM claims are identity facts, not final permission. Accepted security-layer model v0.8 §§6/9.7 keeps one PDP, exact binding/lifetimes and input-class revocation visibility.

FLEX-DEC-2026-019 and docs/application-access-readback.md §§2/8 are exact: application.access only means begin using an application and gives no rights inside it; grants/revocations remain package and registry changes under normal review; no grant/revoke surface is delivered to user-domain admins. User Engine accepted this on 2026-10-09. FLEX-WP-0035 remains finished.

Split the remaining obligations without cloning tasks

1. USER-WP-0026-T03 initial application discovery: actual signed-in human account projection over the now-bound catalogue/readback is User-owned integration acceptance with KeyCape human authentication. Attach real human evidence when it exists. Do not wait for a new general Access grant API.
2. Ordinary authenticated catalogue management: User owns application.register mutation, binding validation, audit/event transaction and deployment. Access owes the matching supported check vocabulary and explicit policy/claims admission. R1's genuine denial shows normal path needs restoration; exact scope proposal and provider source/live verification remain outstanding. Track that ask in FLEX-IN-0003, not a reopened FLEX35 or cloned User task.
3. U09 readback and T05 management are different acceptance goals. For T05, first name the authoritative fact being changed: User application membership, IAM group/role, tenant-role grant, or Access package/registry policy. Each stays with its existing owner and remains subject to Access evaluation. A request for a generic grant/revoke HTTP surface is new product design, not an implicit unmet requirement of the delivered advisory readback. Until that exact authority/scope choice is reviewed, Access owes no invented endpoint. No unsupported self-entitlement admin surface should be exposed.
4. Revocation evidence must name the actual changed input class. KeyCape claims change, package/registry activation and allow expiry are distinct. Reuse docs/decision-input-freshness.md; do not claim that a local membership deletion or logout revokes already-issued JWTs globally. Real scoped mutation acceptance stays open in USER-WP-0028-T02 until owners select it.

No open Access workplan implements ordinary User catalogue-management admission. FLEX-WP-0009 is finished historical policy deployment, FLEX35 is finished readback, FLEX36 is runtime rename, and FLEX31 is audit emission. The fresh live obligor response intake FLEX-IN-0003 is necessary. It is bounded to provider contract/source proposal, not whole User journeys or new standing grants. The waiting plan is beneficiary; a local-only response case connects it to that intake. Human login gates remain separate decision commitments.

Reviewed independent verification SHA-256: 22af2db044ed510863f883b0836f1bedc5f95a69fb0c8f99f4bf9ce3bfd52a64.

Source revision digests reviewed

• /home/worsch/access-engine/INTENT.md: SHA-256 f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5.
• /home/worsch/access-engine/docs/application-access-readback.md: SHA-256 197f017207879f25996f886d70a76931e2aa7d3e3685a1ee9f3ebbfc2192e1c8.
• /home/worsch/access-engine/docs/decision-input-freshness.md: SHA-256 28c5d0d95d3a5f29c190e018305eb9931ee1d75525651e0275298dc7a1e2497c.
• /home/worsch/access-engine/values/user-engine.yaml: SHA-256 eece796adf96ba50f1b210b58377d96ad88b3f1d287bb9e5c5d7c22a4037f460.
• /home/worsch/access-engine/examples/user-engine/policy_package.md: SHA-256 d74e780fc694f1e4fe353d9c48c0d3464097b0665c6fdfdf1c884bfd0720ee7d.
• /home/worsch/net-kingdom/canon/standards/security-layer-model_v0.8.md: SHA-256 3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b.
• /home/worsch/net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md: SHA-256 ea49fb9d9301e441a91bfe91d3ee9b13f660b081be87b4c28dee2fa8c36c6f1a.
• /home/worsch/net-kingdom/canon/standards/iam-profile_v0.4.md: SHA-256 f43bb2dcfab63fb79a936ed8e04f7b7c2fc354c755df39ba73e3a994fdd98088.
• /home/worsch/user-engine/INTENT.md: SHA-256 8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4.