tegwick
b5da745063
- application.access allows only with purpose=readback and the authoring human bar; no workload path, no audience or client-scoped claims - v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04 - examples/application-readback: readback catalogue with informed-decision's key-cape client binding; integration test over the shipped files Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
17 lines
863 B
Markdown
17 lines
863 B
Markdown
# Application access readback catalogue
|
|
|
|
The readback pin's own registry (`FLEX-WP-0035`, `FLEX-DEC-2026-019`). It holds
|
|
one entry per application that user-engine may list: id, display name, and the
|
|
key-cape client its users sign in through. The entries are descriptive only and
|
|
never decide an allow. Allow comes from each application's own package, which
|
|
must declare `application.access`.
|
|
|
|
Participants' registries are loaded alongside this one, and their packages are
|
|
loaded at the same files their own pins run:
|
|
|
|
| System | Package | Registry |
|
|
| --- | --- | --- |
|
|
| `informed-decision` | `examples/informed-decision-lifecycle/policy.md` (v2) | `examples/informed-decision-lifecycle/registry.json` |
|
|
|
|
`client_binding` sources: `informed-decision/docs/keycape-client-registration.md`
|
|
(`client_id`) and `informed-decision/informed_decision/oidc.py` (issuer).
|