emergent-security/knowledge/cards/access.md

Access and credentials

Owner route: ops-warden's catalog (warden route find "<need>") identifies the owning lane and runbook; discovery is not an authorization decision. SSH certificate issuance belongs to ops-warden. Other credential lifecycle belongs to secrets-engine over OpenBao, with key-cape for authentication and ops-bridge for transport. Caller-identity conduits do not become secret owners. Gate House establishes doctrine; it is not the runtime credential broker.

Use the current owner catalog and authoritative task scope. Verify target, principal, tenant, purpose, lifetime, and lane before effects. Never select a broader credential because it is accessible. Do not fetch a secret to answer an orientation question. Missing lane: return the need, intended owner, evidence, and gap to ops-warden/ops-mason; do not improvise a custody or IAM path.

access-engine's POST /v1/check returns the operational decision envelope. The protected-effect owner verifies its submitted-request binding, lifetime, and authentic source under that owner's contract. binding.request_digest describes the enriched request; consumer replay uses binding.submitted_request_digest. A reference evaluator result, Statehub decision note, or knowledge receipt is not a runtime allow or approval object.

When approval is required, approval-engine owns the approval fact and atomic consume; informed-decision owns the human-facing question. The composed ActionAuthorization draft was deferred: do not build a validator against it. Missing decision/approval or an unreachable engine follows the owning PEP's published stance, never an agent-selected fail-open fallback.

Source owner IDs (cite the relevant owner, not an invented umbrella): ops-warden, secrets-engine, key-cape, access-engine, approval-engine, informed-decision, ops-bridge.