---
id: FLEX-WP-0027
type: workplan
title: "Admit scoped human review for the three T03 actions"
domain: infotech
repo: flex-auth
status: active
flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-09-14"
updated: "2026-09-14"
state_hub_workstream_id: "954635b2-8377-5227-ab4f-10607b2a02c6"
---

## Implement the explicit group and exact-record mandate

```task
id: FLEX-WP-0027-T01
status: done
priority: high
state_hub_task_id: "7b5af88b-2630-5f94-a085-78180690e08c"
```

The operator admitted net-kingdom-admins for the three T03 reviews only.
`examples/informed-decision-t03` pins record IDs, versions and native bindings.
Fresh verified KeyCape MFA and groups are mandatory. 57 evaluator checks pass.
Reproduce with `python3 tools/exercise_t03_review_policy.py --binary /path/to/flex-auth --receipt /tmp/t03-checks.json`.

## Deploy the isolated caller-bound policy

```task
id: FLEX-WP-0027-T02
status: done
priority: high
state_hub_task_id: "129568a0-cb1c-5f7b-8f5d-f44f1d2bcfff"
```

`values/informed-decision-t03.yaml` pins the live image and policy. TokenReview
admits only system:serviceaccount:informed-decision:review. Six native caller
checks pass with synthetic identities; evidence is retained in docs/evidence.

## Verify actual human review through the native service

```task
id: FLEX-WP-0027-T03
status: wait
priority: high
state_hub_task_id: "9417d64a-308c-566f-af29-217c5c45d294"
```

Wait for the operator's exact signed-in account, then address the three memos
and verify actual human acknowledgements/entries. Synthetic policy checks are
not acceptance evidence. SECRETS-WP-0010-T03 retains live consume and execution.