---
id: FLEX-WP-0018
type: workplan
title: "Inbound caller-auth and deployment documentation corrections"
domain: infotech
repo: flex-auth
status: finished
owner: codex
topic_slug: netkingdom
planning_priority: P2
planning_order: 118
created: "2026-08-23"
updated: "2026-08-23"
---

## Classify rejected TokenReview credentials as unauthenticated

```task
id: FLEX-WP-0018-T01
status: done
priority: medium
```

Treat a successful TokenReview response that rejects a bearer token as an
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
HTTP, and response-decode failures. Regression coverage exercises the reviewer
and authenticator seam.

## Correct NetworkPolicy egress documentation

```task
id: FLEX-WP-0018-T02
status: done
priority: low
```

Document that caller-authenticated pins permit TCP 443 and 6443 without a
destination selector for Kubernetes TokenReview, while pins without caller
authentication retain deny-all egress.