tegwick
f2b3eeefd8
Publishes tenancy.yaml (I1 A0 E2 P n/a R n/a, enables A3), the review answering rapp-postgres's three asks, and FLEX-WP-0015 to close the gaps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
62 lines
2.6 KiB
YAML
62 lines
2.6 KiB
YAML
# flex-auth tenancy posture declaration
|
|
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md (§5)
|
|
# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
|
|
# Reasoning and evidence: docs/tenancy-posture-review.md
|
|
|
|
service: flex-auth
|
|
role: policy-decision-point
|
|
|
|
tenancy:
|
|
current:
|
|
I: 1
|
|
A: 0
|
|
E: 2
|
|
P: "n/a"
|
|
R: "n/a"
|
|
target:
|
|
I: 1
|
|
A: 2
|
|
E: 2
|
|
P: "n/a"
|
|
R: "n/a"
|
|
reviewed: "2026-08-17"
|
|
service_class: latency-critical
|
|
|
|
# flex-auth is the PDP, not a PEP. The A ladder as written describes
|
|
# enforcement points delegating outward; flex-auth is the thing delegated to.
|
|
# Two numbers are therefore needed and only one has a slot (see review §3.1).
|
|
enables_for_consumers: 3
|
|
|
|
gap:
|
|
I: >-
|
|
Subject and tenant arrive in the CheckRequest body, asserted by the
|
|
calling PEP. flex-auth verifies no token and holds no session. This is
|
|
I1 by §4.1's literal rule and is structurally correct for a PDP: the
|
|
decision point judges asserted claims, it cannot be the verifier of its
|
|
own inputs. Not a defect and not a target for movement.
|
|
A: >-
|
|
POST /v1/check and /v1/batch_check authenticate no caller. Any workload
|
|
with network reach to the ClusterIP Service can assert any subject and
|
|
any tenant and receive an authoritative decision. Mitigated only by
|
|
cluster-internal exposure. Target A2 (single inbound choke point binding
|
|
caller identity) under FLEX-WP-0015-T02.
|
|
E: >-
|
|
No tenant data at rest. Tenant scoping in decisions runs through one
|
|
choke point (internal/decision/engine.go normalizeRequest and the
|
|
relationship tenant match). E2 evidence is adversarial per §13.2 and is
|
|
not yet produced; the claim rests on code review only, which §13
|
|
does not accept. Treat E2 as asserted-pending-evidence.
|
|
P: >-
|
|
No rung applies. flex-auth holds no datastore: registry snapshot and
|
|
policy package are baked into the image and mounted read-only, and the
|
|
production Deployment runs with no --log flag. P0 is the framework's
|
|
floor and presupposes a database. Declaring P0 would be a fabrication.
|
|
R: >-
|
|
No rung applies, same reason. No tenant data is persisted in production,
|
|
so there is nothing to retain or erase. R0 ("kept indefinitely by
|
|
default") would misdescribe a service that keeps nothing.
|
|
|
|
evidence:
|
|
A: "None. A0 is a declared absence, not a claim; see review §3.5 on low-rung evidence."
|
|
E2: "Pending adversarial artifact. Code choke point: internal/decision/engine.go:188,248"
|
|
deployment: "deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"
|