coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): adopt security zone stances
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:17:13 +02:00
parent fbef547cfa
commit e521e7b715
8 changed files with 248 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

77
examples/ops-warden/policy_fixtures.yaml
View file

@ -24,7 +24,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -67,7 +69,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -108,7 +112,9 @@
"allowed_principals": [
"backup"
],
"max_ttl_hours": 1
"max_ttl_hours": 1,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -150,7 +156,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -192,7 +200,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -234,7 +244,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -276,7 +288,9 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -318,7 +332,9 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -333,5 +349,50 @@
"effect": "deny",
"reason": "missing_pubkey_fingerprint"
}
},
{
"id": "fixture:ops-warden-unknown-zone-advisory",
"request": {
"id": "check:ops-warden-unknown-zone",
"tenant": "tenant:platform",
"subject": {
"id": "platform-steward",
"type": "adm"
},
"action": "sign",
"resource": {
"id": "ssh-cert:actor/platform-steward",
"type": "ssh-certificate",
"system": "ops-warden",
"attributes": {
"actor_id": "platform-steward",
"actor_type": "adm",
"allowed_subjects": [
"platform-steward",
"iam:platform-steward"
],
"allowed_principals": [
"platform",
"root"
],
"max_ttl_hours": 8,
"security_zone": "unknown",
"security_zone_admission": "unknown"
}
},
"context": {
"principals": [
"platform",
"root"
],
"actor_type": "adm",
"ttl_hours": 4,
"pubkey_fingerprint": "SHA256:example-adm-fingerprint"
}
},
"expect": {
"effect": "audit_only",
"reason": "advisory_would_signing_policy_matched"
}
}
]

65
examples/ops-warden/policy_package.md
View file

@ -2,7 +2,7 @@
id: ops-warden.ssh-certificate.sign
name: Ops-Warden SSH certificate signing
namespace: ops-warden:ssh-certificate
version: v1
version: v2
status: ready
package: flexauth.ops_warden.ssh_signing
actions:
@ -41,12 +41,13 @@ activation:
mode: local
metadata:
source: examples/ops-warden/policy_package.md
ops_warden_policy_gate: v2
ops_warden_policy_gate: security-zones-v0.1
security_zone_standard: security-zones_v0.1
---
# Ops-Warden SSH Certificate Signing
This package authorizes ops-warden's opt-in pre-sign policy gate. The caller
This package authorizes ops-warden's zone-aware pre-sign policy gate. The caller
keeps SSH CA custody, actor inventory, and OpenBao signing; flex-auth decides
whether a specific `sign` request is allowed now.
@ -60,11 +61,45 @@ import future.keywords.in
actor_types := {"adm", "agt", "atm"}
decision := {"effect": "allow", "reason": "signing_policy_matched"} if {
security_zone_stance == "enforced"
allowed
} else := {"effect": "deny", "reason": first_denial} if {
security_zone_stance == "enforced"
} else := {"effect": "audit_only", "reason": advisory_reason} if {
true
}
default security_zone := "unknown"
security_zone := input.resource.attributes.security_zone if {
input.resource.attributes.security_zone in {
"z0-experimental",
"z1-operational",
"z2-protected",
"z2-continuity",
"z3-critical",
"unknown",
}
}
default security_zone_stance := "advisory"
security_zone_stance := "enforced" if {
security_zone in {"z2-protected", "z2-continuity", "z3-critical"}
}
security_zone_stance := "enforced" if {
input.resource.attributes.security_zone_admission == "not-applicable"
}
base_reason := "signing_policy_matched" if {
allowed
} else := first_denial if {
true
}
advisory_reason := sprintf("advisory_would_%s", [base_reason])
allowed if {
input.action == "sign"
input.resource.system == "ops-warden"
@ -211,7 +246,9 @@ adm_request := {
"actor_type": "adm",
"allowed_subjects": ["platform-steward", "iam:platform-steward"],
"allowed_principals": ["platform", "root"],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -254,4 +291,24 @@ test_missing_fingerprint_denied if {
}
}
}
test_unknown_zone_is_advisory if {
ssh_signing.decision.effect == "audit_only" with input as object.union(
adm_request,
{"resource": object.union(adm_request.resource, {"attributes": object.union(
adm_request.resource.attributes,
{"security_zone": "unknown", "security_zone_admission": "unknown"},
)})},
)
}
test_native_non_workload_subject_keeps_enforced_policy if {
ssh_signing.decision.effect == "allow" with input as object.union(
adm_request,
{"resource": object.union(adm_request.resource, {"attributes": object.union(
adm_request.resource.attributes,
{"security_zone": "unknown", "security_zone_admission": "not-applicable"},
)})},
)
}
```

31
examples/ops-warden/production_registry_snapshot.json
View file

@ -48,8 +48,8 @@
],
"metadata": {
"flex_auth_contract": "protected-system-v0",
"ops_warden_policy_gate": "v2",
"policy_enabled_config": "policy.enabled",
"ops_warden_policy_gate": "security-zones-v0.1",
"security_zone_standard": "security-zones_v0.1",
"tenant": "tenant:platform"
}
}
@ -66,7 +66,6 @@
"ssh-signing",
"adm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "adm-example",
@ -78,7 +77,10 @@
"allowed_principals": [
"adm-full"
],
"max_ttl_hours": 48
"max_ttl_hours": 48,
"security_zone": "unknown",
"security_zone_admission": "not-applicable",
"security_zone_reason": "human operator retains native actor identity"
}
},
{
@ -88,7 +90,6 @@
"ssh-signing",
"agt"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "agt-codex-interhub-bootstrap",
@ -100,7 +101,11 @@
"allowed_principals": [
"agt-interhub-bootstrap"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"workload_id": "codex-interhub-bootstrap",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
},
{
@ -110,7 +115,6 @@
"ssh-signing",
"agt"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "agt-state-hub-bridge",
@ -122,7 +126,11 @@
"allowed_principals": [
"agt-task-bridge"
],
"max_ttl_hours": 24
"max_ttl_hours": 24,
"workload_id": "ops-bridge-tunnel",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
},
{
@ -132,7 +140,6 @@
"ssh-signing",
"atm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "atm-backup-daily",
@ -144,7 +151,11 @@
"allowed_principals": [
"atm-backup-daily"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"workload_id": "backup-daily",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
}
],

24
examples/ops-warden/registry_snapshot.json
View file

@ -48,9 +48,9 @@
],
"metadata": {
"flex_auth_contract": "protected-system-v0",
"ops_warden_policy_gate": "v2",
"policy_enabled_config": "policy.enabled",
"tenant": "tenant:platform"
"ops_warden_policy_gate": "security-zones-v0.1",
"tenant": "tenant:platform",
"security_zone_standard": "security-zones_v0.1"
}
}
],
@ -66,7 +66,6 @@
"ssh-signing",
"adm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "platform-steward",
@ -79,7 +78,10 @@
"platform",
"root"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied",
"security_zone_reason": "fixture_enforced"
}
},
{
@ -89,7 +91,6 @@
"ssh-signing",
"agt"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "ci-deploy-agent",
@ -102,7 +103,10 @@
"deploy",
"git"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied",
"security_zone_reason": "fixture_enforced"
}
},
{
@ -112,7 +116,6 @@
"ssh-signing",
"atm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "backup-automation",
@ -124,7 +127,10 @@
"allowed_principals": [
"backup"
],
"max_ttl_hours": 1
"max_ttl_hours": 1,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied",
"security_zone_reason": "fixture_enforced"
}
}
],