---
id: FLEX-WP-0028
type: workplan
title: "Admit scoped human review for the seven compact sitting memos"
domain: infotech
repo: flex-auth
status: active
flavor: implementation
owner: grok
topic_slug: netkingdom
created: "2026-09-15"
updated: "2026-09-15"
related_workplans:
  - FLEX-WP-0027
  - INFD-WP-0002
---

Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`.
Do not widen `examples/informed-decision-t03` / FLEX-WP-0027.

## Compile the seven-record sitting mandate

```task
id: FLEX-WP-0028-T01
status: done
priority: high
```

Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`.
`examples/informed-decision-sitting` binds the seven native approval ids and
digests. `memo:infd-20260914-c01` is omitted. Same identity bar as T03.
147 evaluator checks pass (42 allow / 105 deny), including omitted c01, T03
memo ids, consume, and identity refusals. T03's 57 checks still pass.
Reproduce with `python3 tools/exercise_sitting_review_policy.py --binary /path/to/flex-auth --receipt /tmp/sitting-checks.json`.
Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`.

## Deploy the isolated caller-bound policy

```task
id: FLEX-WP-0028-T02
status: wait
priority: high
```

Wait for CI to publish an image that contains `examples/informed-decision-sitting`,
then pin `values/informed-decision-sitting.yaml` by digest and helm-upgrade a
new release. Do not reuse the T03 image or change the T03 Deployment.
TokenReview admits only `system:serviceaccount:informed-decision:review`.
Native caller checks with synthetic identities are required before calling
this admitted. Human bind stays with INFD-WP-0002.