A policy-as-code capable authorization registry/control-plane service.
tegwick
bf649ee17d
glas-harness asked for a supported owner access path with authenticated caller binding and lifetime, ruling out Service DNS and a permanent operator token. Both refusals are correct and the answer needs no new mechanism: a TokenRequest token is short-lived, audience-scoped, and bound by exact sub to the ServiceAccount the deployed pin already names. Two findings came out of designing it. First, for an operator caller the pin's NetworkPolicy is not a partial control, it is silent: kubectl port-forward is proxied to the pod's own loopback and no policy selector is consulted. So under warn the operator path is unauthenticated and unfiltered, and the only reason it is not reachable is that nobody has forwarded the port. warn was safe for ops-warden because a workload pin still admitted one pod; here the warn window protects nothing while it runs. enforce is the deliverable. Second, the ServiceAccount named by the deployed binding does not exist. Namespace secrets-engine holds only default, so enforce today would deny every request rather than authenticate one. Third, and this is the contract one: the decision record has no caller field. provenance carries evaluator, mode, policy and registry digests and decision time; binding carries the normalized request. So the four negative tests can all pass and no artifact retains that they passed for the request that mattered. Same seam as FLEX-DEC-2026-008 one layer up — there a tenant was carried into the digest and never compared, visible but not enforced; here a caller is authenticated and never recorded, enforced but not visible. provenance.caller, not binding.caller: the same request from a different authenticated caller must decide identically, so the caller is not replay identity and must not move request_digest. FLEX-DEC-2026-009. Live receipts are not included. kubectl create token is credential minting and was refused in this session, correctly; the commands are exact and the expectations read out of internal/callerauth/auth.go, but nothing is claimed as verified that was not run. Also records the operator's tenant:platform decision (5ed3fb35-eca9-413a-82b9-95171ba85bf6) and verifies that v2 already enforces exactly it — exact string equality, no alias, no normalisation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014aQMM1dPXaPiXVn6DwwtLd Assistant: claude-code Assistant-Model: opus Assistant-Process: 715613@bnt-lap001 Assistant-Session: fabd95c1-4c9e-4080-8849-8707ae025f80 |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .github/workflows | ||
| .repo-manager | ||
| charts/flex-auth | ||
| cmd/flex-auth | ||
| decisions | ||
| deploy | ||
| docs | ||
| examples | ||
| history | ||
| intakes | ||
| internal | ||
| pkg/api | ||
| railiance | ||
| registry | ||
| schemas | ||
| tests | ||
| tools | ||
| values | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .golangci.yml | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| Containerfile | ||
| go.mod | ||
| go.sum | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SCOPE.md | ||
| tenancy.yaml | ||
| WORK-RECORDS.md | ||
flex-auth
Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.
Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.
The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.
The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.
The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.
Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.