---
id: FLEX-WP-0018
type: workplan
title: "Inbound caller-auth and deployment documentation corrections"
domain: infotech
repo: flex-auth
status: finished
owner: codex
topic_slug: netkingdom
planning_priority: P2
planning_order: 118
created: "2026-08-23"
updated: "2026-08-23"
state_hub_workstream_id: "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f"
---

## Classify rejected TokenReview credentials as unauthenticated

```task
id: FLEX-WP-0018-T01
status: done
priority: medium
state_hub_task_id: "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b"
```

Treat a successful TokenReview response that rejects a bearer token as an
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
HTTP, and response-decode failures. Regression coverage exercises the reviewer
and authenticator seam.

## Correct NetworkPolicy egress documentation

```task
id: FLEX-WP-0018-T02
status: done
priority: low
state_hub_task_id: "5613aeb1-ad09-50e5-9933-ced39593dc54"
```

Document that caller-authenticated pins permit TCP 443 and 6443 without a
destination selector for Kubernetes TokenReview, while pins without caller
authentication retain deny-all egress.