approval-engine/registry/capabilities/capability.security.approval-lifecycle.md

id	owner	status	domain	maturity	external_evidence	name	summary	tags	discovery	availability	relations	evidence	consumer_guidance
capability.security.approval-lifecycle	approval-engine	draft	infotech	discovery availability current target confidence rationale D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim. current target confidence rationale A4 A4 medium Source interface assessed 2026-10-14: Authenticated issue, claim, revoke, supersede and atomic consume API with outbox. Availability describes the delivery form, not production acceptance. Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open.	completeness reliability level confidence basis C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review. level confidence basis R0 low No longitudinal consumer reliability measurement established by this review.	Bound approval lifecycle	Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.	security netkingdom framework-reuse	intent includes excludes use_cases Authenticated issue, claim, revoke, supersede and atomic consume API with outbox Authenticated issue, claim, revoke, supersede and atomic consume API with outbox Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open U04: Protected operation obtains and consumes exact human approval before its side effect U05: Operator provisions and delivers a scoped workload credential through the approved owner lane U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity	current_level target_level current_artifacts consumption_modes A4 A4 SCOPE.md approval_engine/api.py docs/production-dependencies.md HTTP API source	related_to capability.authorization.policy-evaluate capability.iam.key-cape capability.security.credential-lifecycle capability.audit.event-retain	documentation SCOPE.md approval_engine/api.py docs/production-dependencies.md	recommended_for not_recommended_for known_limitations Protected operation obtains and consumes exact human approval before its side effect Operator provisions and delivers a scoped workload credential through the approved owner lane Operator or automation obtains a bounded SSH certificate and maintains private connectivity Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.

Bound approval lifecycle

Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.

Reuse boundary

Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open.

Supported use cases

• U04: Protected operation obtains and consumes exact human approval before its side effect
• U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
• U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

Evidence and integration

• SCOPE.md
• approval_engine/api.py
• docs/production-dependencies.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.