# flex-auth tenancy posture declaration
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (§5)
# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
# Reasoning and evidence: docs/tenancy-posture-review.md

service: flex-auth
role: policy-decision-point

tenancy:
  current:
    I: 1
    A: 0
    E: 2
    P: "n/a"
    R: "n/a"
  target:
    I: 1
    A: 2
    E: 2
    P: "n/a"
    R: "n/a"
  reviewed: "2026-08-17"
  service_class: latency-critical

  # flex-auth is the PDP, not a PEP. The A ladder as written describes
  # enforcement points delegating outward; flex-auth is the thing delegated to.
  # Two numbers are therefore needed and only one has a slot (see review §3.1).
  enables_for_consumers: 3

  gap:
    I: >-
      Subject and tenant arrive in the CheckRequest body, asserted by the
      calling PEP. flex-auth verifies no token and holds no session. This is
      I1 by §4.1's literal rule and is structurally correct for a PDP: the
      decision point judges asserted claims, it cannot be the verifier of its
      own inputs. Not a defect and not a target for movement.
    A: >-
      POST /v1/check and /v1/batch_check authenticate no caller. Any workload
      with network reach to the ClusterIP Service can assert any subject and
      any tenant and receive an authoritative decision. Mitigated only by
      cluster-internal exposure. Target A2 (single inbound choke point binding
      caller identity) under FLEX-WP-0015-T02.
    E: >-
      No tenant data at rest. Tenant scoping in decisions runs through one
      choke point (internal/decision/engine.go normalizeRequest and the
      relationship tenant match). E2 evidence is adversarial per §13.2 and is
      not yet produced; the claim rests on code review only, which §13
      does not accept. Treat E2 as asserted-pending-evidence.
    P: >-
      No rung applies. flex-auth holds no datastore: registry snapshot and
      policy package are baked into the image and mounted read-only, and the
      production Deployment runs with no --log flag. P0 is the framework's
      floor and presupposes a database. Declaring P0 would be a fabrication.
    R: >-
      No rung applies, same reason. No tenant data is persisted in production,
      so there is nothing to retain or erase. R0 ("kept indefinitely by
      default") would misdescribe a service that keeps nothing.

evidence:
  A: "None. A0 is a declared absence, not a claim; see review §3.5 on low-rung evidence."
  E2: "Pending adversarial artifact. Code choke point: internal/decision/engine.go:188,248"
  deployment: "deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"