tegwick
ad7b7f536a
list is a separate rule with exact-record scope over the union of the eight
sitting records and the three T03 records, each pinned by approval id, digest and
its own memo version, with a 12-hour MFA window. read and the five acts keep the
v2 rule unchanged — same eight records, same 900-second window — so a list allow
satisfies nothing else.
The operator chose exact-record scope over the consumer's preferred type-wide
scope: the PDP checks no recipient, so type-wide scope with a relaxed window would
have left the consumer's structural match — which the consumer itself says is
not an entitlement — as the only scope. The 12-hour bound replaces the requested
"no bound" so the PDP still states one. The KeyCape stale-timestamp defect is not
worked around; read stays strict.
417 evaluator checks: 168 v2 unchanged, 231 list, 18 proving no act widens to the
T03 records. Also fixes tools/exercise_t03_review_policy.py, which had been
failing since f85479c moved the T03 records to memo version 2 and it still sent
version 1. Test-only.
Not deployed: the pin serving the live review surface changes only with operator
confirmation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
162 lines
6.3 KiB
Markdown
162 lines
6.3 KiB
Markdown
---
|
|
id: FLEX-WP-0032
|
|
type: workplan
|
|
title: "Admit a list action for the informed-decision overview without handing the scope to the consumer"
|
|
domain: infotech
|
|
repo: flex-auth
|
|
status: active
|
|
flavor: implementation
|
|
owner: claude
|
|
topic_slug: netkingdom
|
|
planning_priority: P1
|
|
planning_order: 320
|
|
related_workplans:
|
|
- FLEX-WP-0027
|
|
- FLEX-WP-0028
|
|
created: "2026-09-21"
|
|
updated: "2026-09-21"
|
|
state_hub_workstream_id: "ab21b09f-2cb5-5d31-866d-11f02f13f3d8"
|
|
---
|
|
|
|
# FLEX-WP-0032 — `list` for the informed-decision decision overview
|
|
|
|
Opened from informed-decision intake `INFD-IN-0008` (`INFD-WP-0004-T02`), hub
|
|
message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`. Full request:
|
|
`informed-decision/docs/flex-auth-request-list-action.md` @ `98c8de0`.
|
|
|
|
## What is asked
|
|
|
|
A new action, `list`, on `decision-memo` resources of system
|
|
`informed-decision`: the same identity bar as `read` **minus the 900-second MFA
|
|
freshness window**, over the memos of **both** admitted packages, shipped as v3
|
|
of `informed-decision.compact-sitting`. A `list` allow shows only memo id,
|
|
version and question, the live approval status, and the person's own responses.
|
|
It never shows brief or packet and never enables an act. `read` and every act
|
|
stay as in v2.
|
|
|
|
## Why the request is sound in principle
|
|
|
|
Looking back at your own outcomes is a different act from binding a new one, and
|
|
should not need binding-grade freshness. That holds on its own, **independent of
|
|
the KeyCape defect** that exposed it (`INFD-IN-0005`: KeyCape copies the previous
|
|
session's MFA timestamp even after an actual MFA, so `at` understates freshness).
|
|
The bug is key-cape's to fix; `read` is **not** loosened to work around it.
|
|
Loosening a binding bar to compensate for a claim defect would be the PDP
|
|
silently absorbing an identity-layer fault.
|
|
|
|
## What the PDP checks today — verified
|
|
|
|
The v2 sitting rule (`examples/informed-decision-sitting/policy.md:76`) scopes a
|
|
decision with three things: exact-record pinning (memo id → approval id and
|
|
binding digest), group `net-kingdom-admins`, and fresh AAL2 MFA. It does **not**
|
|
check that the memo is addressed to the subject. Recipient scoping today comes
|
|
from the operator's admission and the consumer's structural match.
|
|
|
|
## The two scope options
|
|
|
|
- **(A) resource-type-wide.** Any `decision-memo` of `informed-decision` in
|
|
`tenant:platform`. Removes exact-record pinning for `list` — and together with
|
|
the dropped freshness window, removes **both** PDP-side scopes at once. The
|
|
only thing between a group member and every memo's question and status would
|
|
be consumer code; flex-auth would record `allow` for memos never admitted by
|
|
anyone and not addressed to the subject. The consumer's own document says its
|
|
structural match "is not an entitlement". A PDP cannot rest an allow on a check
|
|
the consumer disclaims.
|
|
- **(B) exact-record union.** The eight sitting records plus the three T03
|
|
records, pinned by approval id and binding digest as today. The PDP keeps its
|
|
own scope. Costs a package version per sitting — which is the property, not
|
|
the cost: a new memo becomes listable when someone admitted it.
|
|
|
|
Recommendation: **(B)**.
|
|
|
|
## Open decisions (operator)
|
|
|
|
1. **Scope** — (A) or (B). Recommended (B), for the reason above.
|
|
2. **Freshness for `list`** — unbounded as asked, a longer bounded window, or
|
|
decline. Unbounded means an MFA of any age satisfies `list` as long as the
|
|
consumer presents a key-cape session; the PDP would state no bound at all.
|
|
|
|
Both are operator decisions by precedent: the reviewer identity bar on this
|
|
surface was admitted by the operator (`FLEX-WP-0027-T01`, `FLEX-WP-0028`).
|
|
|
|
## 1. Record the decision
|
|
|
|
```task
|
|
id: FLEX-WP-0032-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f741d47e-50b9-5eb1-81d9-ffec847be77a"
|
|
```
|
|
|
|
Owner: operator decides; `flex-auth` records as a `FLEX-DEC`.
|
|
|
|
2026-09-21: done. Operator chose **(B) exact-record** and a **12-hour** MFA
|
|
window for `list`. Recorded as `FLEX-DEC-2026-017`.
|
|
|
|
## 2. Compile compact-sitting v3
|
|
|
|
```task
|
|
id: FLEX-WP-0032-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a24fc5cf-f663-5338-97da-169af7fb47fb"
|
|
```
|
|
|
|
Owner: `flex-auth`.
|
|
|
|
- New `list` rule; `read` and all five acts byte-identical in effect to v2.
|
|
- Under (B), per-record `memo_version`: the three T03 records are at version 2
|
|
(`f85479c`), the sitting records at 1. The v2 rule's global
|
|
`memo_version == 1` cannot be reused for the union.
|
|
- `list` never satisfies any act: a separate rule, not an extra action in the
|
|
existing allow set.
|
|
- A version bump, per `FLEX-DEC-2026-008`: a widened bar must be visible to the
|
|
consumer as a version change.
|
|
|
|
2026-09-21: done. v3, digest
|
|
`sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655`.
|
|
The v2 act rule is kept unchanged so its effect cannot drift; `list` is a
|
|
separate `else` branch. T03 pins in `examples/informed-decision-sitting/list_only_records.json`,
|
|
copied from the T03 package's records.
|
|
|
|
## 3. Fixtures and the exercise receipt
|
|
|
|
```task
|
|
id: FLEX-WP-0032-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "984f11f4-6ec9-5f7d-840b-4dee2e121212"
|
|
```
|
|
|
|
Owner: `flex-auth`, with informed-decision's fixtures.
|
|
|
|
At minimum: stale MFA allowed for `list`, refused for `read`; no group refused;
|
|
agent refused; `principal_type_source` other than `authentication-derived`
|
|
refused; under (B), an unlisted memo refused and each T03 record listable at
|
|
version 2 only. Every v2 check must still pass unchanged — the existing 147
|
|
sitting checks and T03's 57.
|
|
|
|
Gate: `flex-auth validate`, `test-policy`, and the exercise scripts green; a
|
|
receipt in `docs/evidence/`.
|
|
|
|
2026-09-21: done. 417 checks (168 v2 unchanged, 231 `list`, 18 no-act-widening),
|
|
receipt `docs/evidence/2026-09-21-sitting-review-policy-v3.json`; validate and
|
|
three Rego tests green; T03's 57 pass.
|
|
|
|
Found on the way: `tools/exercise_t03_review_policy.py` had been failing since
|
|
`f85479c` moved the T03 records to memo version 2 — it still sent version 1, so
|
|
the reproduce command `FLEX-WP-0027-T01` cites was broken. Fixed to read each
|
|
record's own version. Test-only; no policy change.
|
|
|
|
## 4. Publish and hand back
|
|
|
|
```task
|
|
id: FLEX-WP-0032-T04
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"
|
|
```
|
|
|
|
Owner: `flex-auth` publishes the package, version and digest; informed-decision
|
|
updates its admission input. **Deploying the pin is a production change to a
|
|
live human-review surface and is confirmed with the operator before it runs.**
|