tegwick
a835c11ae7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea
29 lines
1.8 KiB
Markdown
29 lines
1.8 KiB
Markdown
# Access and credentials
|
|
|
|
Owner route: ops-warden's catalog (`warden route find "<need>"`) identifies
|
|
the owning lane and runbook; discovery is not an authorization decision.
|
|
SSH certificate issuance belongs to ops-warden. Other credential lifecycle
|
|
belongs to secrets-engine over OpenBao, with key-cape for authentication and
|
|
ops-bridge for transport. Caller-identity conduits do not become secret owners.
|
|
Gate House establishes doctrine; it is not the runtime credential broker.
|
|
|
|
Use the current owner catalog and authoritative task scope. Verify target,
|
|
principal, tenant, purpose, lifetime, and lane before effects. Never select a
|
|
broader credential because it is accessible. Do not fetch a secret to answer an
|
|
orientation question. Missing lane: return the need, intended owner, evidence,
|
|
and gap to ops-warden/ops-mason; do not improvise a custody or IAM path.
|
|
|
|
access-engine's `POST /v1/check` returns the operational decision envelope.
|
|
The protected-effect owner verifies its submitted-request binding, lifetime,
|
|
and authentic source under that owner's contract. `binding.request_digest`
|
|
describes the enriched request; consumer replay uses
|
|
`binding.submitted_request_digest`. A reference evaluator result, Statehub
|
|
decision note, or knowledge receipt is not a runtime allow or approval object.
|
|
|
|
When approval is required, approval-engine owns the approval fact and atomic
|
|
consume; informed-decision owns the human-facing question. The composed
|
|
ActionAuthorization draft was deferred: do not build a validator against it.
|
|
Missing decision/approval or an unreachable engine follows the owning PEP's
|
|
published stance, never an agent-selected fail-open fallback.
|
|
|
|
Source owner IDs (cite the relevant owner, not an invented umbrella): `ops-warden`, `secrets-engine`, `key-cape`, `access-engine`, `approval-engine`, `informed-decision`, `ops-bridge`.
|