tegwick
ee6d66c005
flex-auth stays the only PDP. Zone membership reaches /v1/check as compiled registry data, never a synchronous lookup. Uncommitted tenant-engine read/role/grouping policy was discarded, not mixed into this pin.
91 lines
3.3 KiB
YAML
91 lines
3.3 KiB
YAML
# flex-auth tenancy posture declaration
|
|
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md draft-8 (§5)
|
|
# Conformance rule (§6): accuracy, not altitude. This file overclaims nothing.
|
|
# Reasoning and evidence: docs/tenancy-posture-review.md
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-tenancy-posture
|
|
service: flex-auth
|
|
role: policy-decision-point
|
|
|
|
tenancy:
|
|
current:
|
|
I: 1
|
|
A: 2
|
|
E: 1
|
|
P: "n/a"
|
|
R: "n/a"
|
|
V: 0
|
|
implemented:
|
|
A: 2
|
|
E: 2
|
|
target:
|
|
I: 1
|
|
A: 2
|
|
E: 2
|
|
P: "n/a"
|
|
R: "n/a"
|
|
V: 1
|
|
reviewed: "2026-08-18"
|
|
review_due: "2027-02-17"
|
|
service_class: latency-critical
|
|
permanent: [I, P, R]
|
|
|
|
gap:
|
|
I: >-
|
|
Subject and tenant arrive in the CheckRequest body, asserted by the
|
|
calling PEP. flex-auth verifies no token and holds no session. This is
|
|
I1 by §4.1's literal rule and is structurally correct for a PDP: the
|
|
decision point judges asserted claims, it cannot be the verifier of its
|
|
own inputs. Not a defect and not a target for movement.
|
|
A: >-
|
|
All three production pins are live A2 as of 2026-08-19 on digest
|
|
sha256:138aa347… with callerAuth.mode=enforce (user-engine,
|
|
tenant-engine, isolated ops-warden). Unbound requests return 401; a
|
|
token bound to the other protected system returns 403. Zone
|
|
membership, if any, reaches this PDP only as compiled registry
|
|
data — never a synchronous zone-engine lookup.
|
|
E: >-
|
|
No tenant data at rest. Tenant scoping in decisions runs through one
|
|
choke point (internal/decision/engine.go normalizeRequest and the
|
|
relationship tenant match). E2 evidence is adversarial per §13.2 and is
|
|
not yet produced. Draft-8 distinguishes implemented from evidenced, so
|
|
current remains E1 until that review exists.
|
|
P: >-
|
|
No rung applies. flex-auth holds no datastore: registry snapshot and
|
|
policy package are baked into the image and mounted read-only, and the
|
|
production Deployment runs with no --log flag. P0 is the framework's
|
|
floor and presupposes a database. Declaring P0 would be a fabrication.
|
|
R: >-
|
|
No rung applies, same reason. No tenant data is persisted in production,
|
|
so there is nothing to retain or erase. R0 ("kept indefinitely by
|
|
default") would misdescribe a service that keeps nothing.
|
|
V: >-
|
|
No restart or failover exercise establishes an availability position for
|
|
the complete decision path. The target is exercised V1 recovery, not an
|
|
inferred claim from a Deployment manifest.
|
|
|
|
provider:
|
|
capability: authorization.decision
|
|
axes:
|
|
A:
|
|
available: 3
|
|
maximum: 4
|
|
conditions:
|
|
- "A3 consumers authenticate flex-auth and observe a denial at their endpoint."
|
|
- "A4 requires the AuthZEN interface and records decision differences between PDPs."
|
|
evidence:
|
|
- "docs/tenancy-posture-review.md"
|
|
|
|
evidence:
|
|
E1:
|
|
- "internal/decision/engine.go:188"
|
|
- "internal/decision/engine.go:248"
|
|
A2:
|
|
- "internal/callerauth/auth.go"
|
|
- "internal/callerauth/auth_test.go"
|
|
- "cmd/flex-auth/main_test.go"
|
|
- "charts/flex-auth/templates/rbac.yaml"
|
|
- "deploy/caller-auth-rbac.yaml"
|
|
- "docs/adr/0004-inbound-caller-authentication.md"
|
|
deployment: "values/user-engine.yaml, values/tenant-engine.yaml, deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"
|