coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit exact T03 human review mandate with caller-bound policy
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 02:47:31 +02:00
parent 8dcdecf6cf
commit e62c0cfc36
10 changed files with 585 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

47
docs/evidence/2026-09-14-t03-native-review-policy.json Normal file
View file

@ -0,0 +1,47 @@
{
"scope": "native caller and policy with synthetic subject claims; not real human approval",
"checks": [
{
"action": "apply",
"case": "admitted-group",
"effect": "allow",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
},
{
"action": "apply",
"case": "unrelated-group",
"effect": "deny",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
},
{
"action": "verify",
"case": "admitted-group",
"effect": "allow",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
},
{
"action": "verify",
"case": "unrelated-group",
"effect": "deny",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
},
{
"action": "exec",
"case": "admitted-group",
"effect": "allow",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
},
{
"action": "exec",
"case": "unrelated-group",
"effect": "deny",
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
"caller": "system:serviceaccount:informed-decision:review"
}
]
}

233
docs/evidence/2026-09-14-t03-review-policy.json Normal file
View file

@ -0,0 +1,233 @@
{
"scope": "local actual evaluator with synthetic identity; no live human approvals",
"checks": [
{
"check": "apply:read",
"effect": "allow"
},
{
"check": "apply:acknowledge",
"effect": "allow"
},
{
"check": "apply:accept",
"effect": "allow"
},
{
"check": "apply:return",
"effect": "allow"
},
{
"check": "apply:discuss",
"effect": "allow"
},
{
"check": "apply:decline",
"effect": "allow"
},
{
"check": "apply:wrong-group",
"effect": "deny"
},
{
"check": "apply:no-group",
"effect": "deny"
},
{
"check": "apply:service",
"effect": "deny"
},
{
"check": "apply:stale-mfa",
"effect": "deny"
},
{
"check": "apply:future-mfa",
"effect": "deny"
},
{
"check": "apply:no-mfa",
"effect": "deny"
},
{
"check": "apply:forged-human-route",
"effect": "deny"
},
{
"check": "apply:wrong-tenant",
"effect": "deny"
},
{
"check": "apply:other-memo",
"effect": "deny"
},
{
"check": "apply:changed-version",
"effect": "deny"
},
{
"check": "apply:changed-approval",
"effect": "deny"
},
{
"check": "apply:changed-digest",
"effect": "deny"
},
{
"check": "apply:consume",
"effect": "deny"
},
{
"check": "verify:read",
"effect": "allow"
},
{
"check": "verify:acknowledge",
"effect": "allow"
},
{
"check": "verify:accept",
"effect": "allow"
},
{
"check": "verify:return",
"effect": "allow"
},
{
"check": "verify:discuss",
"effect": "allow"
},
{
"check": "verify:decline",
"effect": "allow"
},
{
"check": "verify:wrong-group",
"effect": "deny"
},
{
"check": "verify:no-group",
"effect": "deny"
},
{
"check": "verify:service",
"effect": "deny"
},
{
"check": "verify:stale-mfa",
"effect": "deny"
},
{
"check": "verify:future-mfa",
"effect": "deny"
},
{
"check": "verify:no-mfa",
"effect": "deny"
},
{
"check": "verify:forged-human-route",
"effect": "deny"
},
{
"check": "verify:wrong-tenant",
"effect": "deny"
},
{
"check": "verify:other-memo",
"effect": "deny"
},
{
"check": "verify:changed-version",
"effect": "deny"
},
{
"check": "verify:changed-approval",
"effect": "deny"
},
{
"check": "verify:changed-digest",
"effect": "deny"
},
{
"check": "verify:consume",
"effect": "deny"
},
{
"check": "exec:read",
"effect": "allow"
},
{
"check": "exec:acknowledge",
"effect": "allow"
},
{
"check": "exec:accept",
"effect": "allow"
},
{
"check": "exec:return",
"effect": "allow"
},
{
"check": "exec:discuss",
"effect": "allow"
},
{
"check": "exec:decline",
"effect": "allow"
},
{
"check": "exec:wrong-group",
"effect": "deny"
},
{
"check": "exec:no-group",
"effect": "deny"
},
{
"check": "exec:service",
"effect": "deny"
},
{
"check": "exec:stale-mfa",
"effect": "deny"
},
{
"check": "exec:future-mfa",
"effect": "deny"
},
{
"check": "exec:no-mfa",
"effect": "deny"
},
{
"check": "exec:forged-human-route",
"effect": "deny"
},
{
"check": "exec:wrong-tenant",
"effect": "deny"
},
{
"check": "exec:other-memo",
"effect": "deny"
},
{
"check": "exec:changed-version",
"effect": "deny"
},
{
"check": "exec:changed-approval",
"effect": "deny"
},
{
"check": "exec:changed-digest",
"effect": "deny"
},
{
"check": "exec:consume",
"effect": "deny"
}
]
}