coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close B2 and finish FLEX-WP-0030; record tenant-engine's and key-cape's answers.

Browse source 
B2: key-cape (Tooling), net-kingdom (Taxonomy) and ops-mason (Staff) now declare
in their own files. Verified by the survey rather than taken on report: 14 of 14
counterparts declared, 0 undeclared. ops-mason sent no reply and needed none —
under §11 the file is the declaration. Every T04 finding is answered, so
FLEX-WP-0030 is finished. B5's residual ping belongs to FLEX-WP-0020.

key-cape stated the identity boundary from its side for the first time and
cautioned that principal_type must not be read as authentication-derived until
GH-DEC-2026-013/-016 §5 is answered. Checked against every published package:
only the two informed-decision packages gate on a human subject, and both also
require principal_type_source == "authentication-derived", which informed-decision
derives from the verified code-flow MFA event rather than from key-cape's claim.
No change needed; the assessment and a warning about the legacy "otherwise ->
human" fallback are in docs/iam-profile-consumption.md.

tenant-engine confirmed FLEX-DEC-2026-016's reading of commitment (b): the
fixed-record exclusion is consistent with it. Recorded under point 3; v3 stands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 22:57:56 +02:00
parent 882b381af6
commit 39a0034fcc
5 changed files with 607 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/iam-profile-consumption.md
View file

@ -126,6 +126,26 @@ This matches Markitect's `NetKingdomIdentityClaimsAdapter._principal_type`
as a compatibility path. New claim envelopes should not force flex-auth
to infer principal type.
**`principal_type` carries no route (key-cape, 2026-09-21).** Whether key-cape
distinguishes a registration-asserted `principal_type` from an
authentication-derived one is open (`GH-DEC-2026-013` / `-016` §5). Until it is
answered, key-cape's own instruction is: **do not read `principal_type` as
authentication-derived.** flex-auth may classify with it; no rule may discharge
a human-in-the-loop control on it alone.
Checked against every published package on that date. Only
`informed-decision-t03` and `informed-decision-sitting` gate on a human subject,
and both also require `principal_type_source == "authentication-derived"`. That
value is not key-cape's `principal_type`: informed-decision derives it from the
verified code-flow MFA event itself (`informed_decision/oidc.py`, refused unless
`aal2`, `pwd`+`otp`, source `key-cape`, fresh `at`). So neither package rests on
the claim key-cape cautioned against, and no change was needed.
The legacy fallback above ends in *"Otherwise → human"*, which defaults to the
strongest reading. It is a compatibility path for classification only; a rule
that needs humanness must require a routed source, as the two packages above do,
and never this default.
## Group Overage and Freshness
Microsoft Entra and Keycloak both clip the `groups` claim once a