flex-auth/workplans/FLEX-WP-0032-informed-decision-list-action.md

---
id: FLEX-WP-0032
type: workplan
title: "Admit a list action for the informed-decision overview without handing the scope to the consumer"
domain: infotech
repo: flex-auth
status: finished
flavor: implementation
owner: claude
topic_slug: netkingdom
planning_priority: P1
planning_order: 320
related_workplans:
  - FLEX-WP-0027
  - FLEX-WP-0028
created: "2026-09-21"
updated: "2026-09-21"
state_hub_workstream_id: "ab21b09f-2cb5-5d31-866d-11f02f13f3d8"
---

# FLEX-WP-0032 — `list` for the informed-decision decision overview

Opened from informed-decision intake `INFD-IN-0008` (`INFD-WP-0004-T02`), hub
message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`. Full request:
`informed-decision/docs/flex-auth-request-list-action.md` @ `98c8de0`.

## What is asked

A new action, `list`, on `decision-memo` resources of system
`informed-decision`: the same identity bar as `read` **minus the 900-second MFA
freshness window**, over the memos of **both** admitted packages, shipped as v3
of `informed-decision.compact-sitting`. A `list` allow shows only memo id,
version and question, the live approval status, and the person's own responses.
It never shows brief or packet and never enables an act. `read` and every act
stay as in v2.

## Why the request is sound in principle

Looking back at your own outcomes is a different act from binding a new one, and
should not need binding-grade freshness. That holds on its own, **independent of
the KeyCape defect** that exposed it (`INFD-IN-0005`: KeyCape copies the previous
session's MFA timestamp even after an actual MFA, so `at` understates freshness).
The bug is key-cape's to fix; `read` is **not** loosened to work around it.
Loosening a binding bar to compensate for a claim defect would be the PDP
silently absorbing an identity-layer fault.

## What the PDP checks today — verified

The v2 sitting rule (`examples/informed-decision-sitting/policy.md:76`) scopes a
decision with three things: exact-record pinning (memo id → approval id and
binding digest), group `net-kingdom-admins`, and fresh AAL2 MFA. It does **not**
check that the memo is addressed to the subject. Recipient scoping today comes
from the operator's admission and the consumer's structural match.

## The two scope options

- **(A) resource-type-wide.** Any `decision-memo` of `informed-decision` in
  `tenant:platform`. Removes exact-record pinning for `list` — and together with
  the dropped freshness window, removes **both** PDP-side scopes at once. The
  only thing between a group member and every memo's question and status would
  be consumer code; flex-auth would record `allow` for memos never admitted by
  anyone and not addressed to the subject. The consumer's own document says its
  structural match "is not an entitlement". A PDP cannot rest an allow on a check
  the consumer disclaims.
- **(B) exact-record union.** The eight sitting records plus the three T03
  records, pinned by approval id and binding digest as today. The PDP keeps its
  own scope. Costs a package version per sitting — which is the property, not
  the cost: a new memo becomes listable when someone admitted it.

Recommendation: **(B)**.

## Open decisions (operator)

1. **Scope** — (A) or (B). Recommended (B), for the reason above.
2. **Freshness for `list`** — unbounded as asked, a longer bounded window, or
   decline. Unbounded means an MFA of any age satisfies `list` as long as the
   consumer presents a key-cape session; the PDP would state no bound at all.

Both are operator decisions by precedent: the reviewer identity bar on this
surface was admitted by the operator (`FLEX-WP-0027-T01`, `FLEX-WP-0028`).

## 1. Record the decision

```task
id: FLEX-WP-0032-T01
status: done
priority: high
state_hub_task_id: "f741d47e-50b9-5eb1-81d9-ffec847be77a"
```

Owner: operator decides; `flex-auth` records as a `FLEX-DEC`.

2026-09-21: done. Operator chose **(B) exact-record** and a **12-hour** MFA
window for `list`. Recorded as `FLEX-DEC-2026-017`.

## 2. Compile compact-sitting v3

```task
id: FLEX-WP-0032-T02
status: done
priority: high
state_hub_task_id: "a24fc5cf-f663-5338-97da-169af7fb47fb"
```

Owner: `flex-auth`.

- New `list` rule; `read` and all five acts byte-identical in effect to v2.
- Under (B), per-record `memo_version`: the three T03 records are at version 2
  (`f85479c`), the sitting records at 1. The v2 rule's global
  `memo_version == 1` cannot be reused for the union.
- `list` never satisfies any act: a separate rule, not an extra action in the
  existing allow set.
- A version bump, per `FLEX-DEC-2026-008`: a widened bar must be visible to the
  consumer as a version change.

2026-09-21: done. v3, digest
`sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655`.
The v2 act rule is kept unchanged so its effect cannot drift; `list` is a
separate `else` branch. T03 pins in `examples/informed-decision-sitting/list_only_records.json`,
copied from the T03 package's records.

## 3. Fixtures and the exercise receipt

```task
id: FLEX-WP-0032-T03
status: done
priority: high
state_hub_task_id: "984f11f4-6ec9-5f7d-840b-4dee2e121212"
```

Owner: `flex-auth`, with informed-decision's fixtures.

At minimum: stale MFA allowed for `list`, refused for `read`; no group refused;
agent refused; `principal_type_source` other than `authentication-derived`
refused; under (B), an unlisted memo refused and each T03 record listable at
version 2 only. Every v2 check must still pass unchanged — the existing 147
sitting checks and T03's 57.

Gate: `flex-auth validate`, `test-policy`, and the exercise scripts green; a
receipt in `docs/evidence/`.

2026-09-21: done. 417 checks (168 v2 unchanged, 231 `list`, 18 no-act-widening),
receipt `docs/evidence/2026-09-21-sitting-review-policy-v3.json`; validate and
three Rego tests green; T03's 57 pass.

Found on the way: `tools/exercise_t03_review_policy.py` had been failing since
`f85479c` moved the T03 records to memo version 2 — it still sent version 1, so
the reproduce command `FLEX-WP-0027-T01` cites was broken. Fixed to read each
record's own version. Test-only; no policy change.

## 4. Publish and hand back

```task
id: FLEX-WP-0032-T04
status: done
priority: medium
state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"
```

Owner: `flex-auth` publishes the package, version and digest; informed-decision
updates its admission input. **Deploying the pin is a production change to a
live human-review surface and is confirmed with the operator before it runs.**

2026-09-21: done. Operator confirmed and applied the upgrade: release
`flex-auth-informed-decision-sitting` revision 3 on railiance01, image
`main-ad7b7f5` = `sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde`.

Verified before rollout: the image's baked package is byte-identical to the
committed v3; the image's own binary computes package digest
`sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655`; live
release values equalled the committed file; the rendered diff against revision 2
was exactly one line, the image digest. Verified after: rollout complete, one pod
Running on `bd616cc2…`, zero restarts.

**Not verified:** a live `/v1/check` through the enforced caller path. The pin
admits only informed-decision's service account, and minting its token to test
as it is not ours to do. informed-decision's first real `list` call is that
check, and a mismatch there is a finding. Rollback:
`helm rollback flex-auth-informed-decision-sitting 2 -n flex-auth`.