flex-auth/tenancy.yaml

# flex-auth tenancy posture declaration
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md draft-8 (§5)
# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
# Reasoning and evidence: docs/tenancy-posture-review.md

schema_version: "0.1"
framework: netkingdom-tenancy-posture
service: flex-auth
role: policy-decision-point

workload_identity:
  name: flex-auth
  kind: platform-service
  responsible_repo: flex-auth
  identity_bindings:
    - scheme: kubernetes-service-account
      authority: railiance01
      subject: system:serviceaccount:flex-auth:flex-auth-ops-warden
      principal_type: service
      environment: prod
    - scheme: kubernetes-service-account
      authority: railiance01
      subject: system:serviceaccount:flex-auth:flex-auth-user-engine
      principal_type: service
      environment: prod
    - scheme: kubernetes-service-account
      authority: railiance01
      subject: system:serviceaccount:flex-auth:flex-auth-tenant-engine
      principal_type: service
      environment: prod

tenancy:
  current:
    I: 1
    A: 2
    E: 1
    P: "n/a"
    R: "n/a"
    V: 0
  implemented:
    A: 2
    E: 2
  target:
    I: 1
    A: 2
    E: 2
    P: "n/a"
    R: "n/a"
    V: 1
  reviewed: "2026-08-18"
  review_due: "2027-02-17"
  service_class: latency-critical
  permanent: [I, P, R]

  gap:
    I: >-
      Subject and tenant arrive in the CheckRequest body, asserted by the
      calling PEP. flex-auth verifies no token and holds no session. This is
      I1 by §4.1's literal rule and is structurally correct for a PDP: the
      decision point judges asserted claims, it cannot be the verifier of its
      own inputs. Not a defect and not a target for movement.
    A: >-
      All three production pins are live A2 as of 2026-08-19 on digest
      sha256:138aa347… with callerAuth.mode=enforce (user-engine,
      tenant-engine, isolated ops-warden). Unbound requests return 401; a
      token bound to the other protected system returns 403. Zone
      membership, if any, reaches this PDP only as compiled registry
      data — never a synchronous zone-engine lookup.
    E: >-
      No tenant data at rest. Tenant scoping in decisions runs through one
      choke point (internal/decision/engine.go normalizeRequest and the
      relationship tenant match). E2 evidence is adversarial per §13.2 and is
      not yet produced. Draft-8 distinguishes implemented from evidenced, so
      current remains E1 until that review exists.
    P: >-
      No rung applies. flex-auth holds no datastore: registry snapshot and
      policy package are baked into the image and mounted read-only, and the
      production Deployment runs with no --log flag. P0 is the framework's
      floor and presupposes a database. Declaring P0 would be a fabrication.
    R: >-
      No rung applies, same reason. No tenant data is persisted in production,
      so there is nothing to retain or erase. R0 ("kept indefinitely by
      default") would misdescribe a service that keeps nothing.
    V: >-
      No restart or failover exercise establishes an availability position for
      the complete decision path. The target is exercised V1 recovery, not an
      inferred claim from a Deployment manifest.

provider:
  capability: authorization.decision
  axes:
    A:
      available: 3
      maximum: 4
      conditions:
        - "A3 consumers authenticate flex-auth and observe a denial at their endpoint."
        - "A4 requires the AuthZEN interface and records decision differences between PDPs."
      evidence:
        - "docs/tenancy-posture-review.md"

zones:
  standard: security-zones_v0.1
  membership: z1-operational
  responsible_party: team:platform-security
  justification: >-
    Three isolated production policy pins have a bounded platform scope and
    internal authorization metadata exposure. M1 is evidenced; absent SLO
    history, on-call, and incident exercises, z2-protected would overclaim.
  context:
    maturity: M1
    criticality: medium
    data_classification: internal
  evidence:
    - ref: docs/evidence/security-zone-admission-2026-08-22.md
      supports: [M1, platform-only-scope, basic-slo, data-handling-note]
    - ref: docs/ops-warden-registry-sync.md
      supports: [production-runbook, decision-observability]
  reviewed: "2026-08-22"
  review_due: "2026-11-22"

evidence:
  E1:
    - "internal/decision/engine.go:188"
    - "internal/decision/engine.go:248"
  A2:
    - "internal/callerauth/auth.go"
    - "internal/callerauth/auth_test.go"
    - "cmd/flex-auth/main_test.go"
    - "charts/flex-auth/templates/rbac.yaml"
    - "deploy/caller-auth-rbac.yaml"
    - "docs/adr/0004-inbound-caller-authentication.md"
  deployment: "values/user-engine.yaml, values/tenant-engine.yaml, deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"