# flex-auth security-zone admission — 2026-08-22

The `flex-auth` workload qualifies for `z1-operational` and does not claim a
higher zone.

- Scope is limited to three separately configured platform consumers. Each pin
  has an explicit policy, registry, and authenticated caller binding.
- The basic service objective is 95% successful `/healthz` and policy checks
  during each consumer's operating window. Decision ids and the existing
  ops-warden registry-sync runbook provide the measurement path. No SLO history
  is claimed; that is one reason M2 is not admitted.
- Requests contain internal identity, authorization, and resource metadata.
  The service stores no tenant data or secret values and production policy and
  registry inputs are read-only.
- The zone-aware ops-warden package is total across every v0.1 zone plus
  `unknown`; flex-auth owns stance while the calling PEP owns failure behavior.

Owner: `team:platform-security`. Re-review with the zone declaration by
2026-11-22.