tegwick
1e1e077b27
TokenReview-based caller identity with audience-scoped tokens and exact resource.system to ServiceAccount bindings, per ops-warden's recommendation. Deletes the unwired tenant-engine live-roles adapter (T03) and adds make verify-posture (T05). Source implements A2; running digest is still A0 until promotion, so tenancy.current.A stays 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
89 lines
3.2 KiB
YAML
89 lines
3.2 KiB
YAML
# flex-auth tenancy posture declaration
|
|
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md draft-8 (§5)
|
|
# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
|
|
# Reasoning and evidence: docs/tenancy-posture-review.md
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-tenancy-posture
|
|
service: flex-auth
|
|
role: policy-decision-point
|
|
|
|
tenancy:
|
|
current:
|
|
I: 1
|
|
A: 0
|
|
E: 1
|
|
P: "n/a"
|
|
R: "n/a"
|
|
V: 0
|
|
implemented:
|
|
A: 2
|
|
E: 2
|
|
target:
|
|
I: 1
|
|
A: 2
|
|
E: 2
|
|
P: "n/a"
|
|
R: "n/a"
|
|
V: 1
|
|
reviewed: "2026-08-18"
|
|
review_due: "2027-02-17"
|
|
service_class: latency-critical
|
|
permanent: [I, P, R]
|
|
|
|
gap:
|
|
I: >-
|
|
Subject and tenant arrive in the CheckRequest body, asserted by the
|
|
calling PEP. flex-auth verifies no token and holds no session. This is
|
|
I1 by §4.1's literal rule and is structurally correct for a PDP: the
|
|
decision point judges asserted claims, it cannot be the verifier of its
|
|
own inputs. Not a defect and not a target for movement.
|
|
A: >-
|
|
The running immutable digest still authenticates no caller, so current
|
|
remains A0. Source and reviewed desired manifests implement A2 with an
|
|
audience-scoped Kubernetes TokenReview choke point and exact
|
|
protected-system-to-ServiceAccount bindings. Promotion and a live
|
|
unbound-request probe remain under FLEX-WP-0011/FLEX-WP-0015-T02.
|
|
E: >-
|
|
No tenant data at rest. Tenant scoping in decisions runs through one
|
|
choke point (internal/decision/engine.go normalizeRequest and the
|
|
relationship tenant match). E2 evidence is adversarial per §13.2 and is
|
|
not yet produced. Draft-8 distinguishes implemented from evidenced, so
|
|
current remains E1 until that review exists.
|
|
P: >-
|
|
No rung applies. flex-auth holds no datastore: registry snapshot and
|
|
policy package are baked into the image and mounted read-only, and the
|
|
production Deployment runs with no --log flag. P0 is the framework's
|
|
floor and presupposes a database. Declaring P0 would be a fabrication.
|
|
R: >-
|
|
No rung applies, same reason. No tenant data is persisted in production,
|
|
so there is nothing to retain or erase. R0 ("kept indefinitely by
|
|
default") would misdescribe a service that keeps nothing.
|
|
V: >-
|
|
No restart or failover exercise establishes an availability position for
|
|
the complete decision path. The target is exercised V1 recovery, not an
|
|
inferred claim from a Deployment manifest.
|
|
|
|
provider:
|
|
capability: authorization.decision
|
|
axes:
|
|
A:
|
|
available: 3
|
|
maximum: 4
|
|
conditions:
|
|
- "A3 consumers authenticate flex-auth and observe a denial at their endpoint."
|
|
- "A4 requires the AuthZEN interface and records decision differences between PDPs."
|
|
evidence:
|
|
- "docs/tenancy-posture-review.md"
|
|
|
|
evidence:
|
|
E1:
|
|
- "internal/decision/engine.go:188"
|
|
- "internal/decision/engine.go:248"
|
|
A2:
|
|
- "internal/callerauth/auth.go"
|
|
- "internal/callerauth/auth_test.go"
|
|
- "cmd/flex-auth/main_test.go"
|
|
- "deploy/caller-auth-rbac.yaml"
|
|
- "docs/adr/0004-inbound-caller-authentication.md"
|
|
deployment: "deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"
|