tegwick
75ce37207f
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
83 lines
3 KiB
Markdown
83 lines
3 KiB
Markdown
# ADR-001 — Canonical authority context contract
|
|
|
|
**Repository:** gate-house
|
|
**Status:** accepted
|
|
**Date:** 2026-09-01
|
|
**Workplan:** GH-WP-0001-T04
|
|
|
|
## Context
|
|
|
|
Gate House owns the vocabulary of an agentic authority request, while
|
|
access-engine is NetKingdom's only policy decision point. The surviving
|
|
`ArchitectureBlueprint.md` material named the required concepts, but left them
|
|
inside an obsolete canonical authorization-request example that also portrayed
|
|
Gate House as an in-path service.
|
|
|
|
Without a standalone contract, consumers can collapse identity roles, infer an
|
|
operating mode, treat caller-supplied context as verified fact, or implement
|
|
incompatible field meanings. Conversely, prescribing an access-engine API or
|
|
executable policy schema here would recreate the Staff/Engine boundary error
|
|
resolved by GH-DEC-2026-001.
|
|
|
|
## Decision
|
|
|
|
Gate House publishes
|
|
[`authority-context.v1`](../contracts/authority-context.md) as a logical claims
|
|
contract.
|
|
|
|
The contract defines eight claims:
|
|
|
|
1. principal;
|
|
2. actor;
|
|
3. runtime identity;
|
|
4. tenant;
|
|
5. environment;
|
|
6. mandate;
|
|
7. task;
|
|
8. operating mode.
|
|
|
|
It defines their meanings, source and binding expectations, mode-specific
|
|
requiredness, fail-closed conditions, evidence obligations, and versioning.
|
|
|
|
The contract is deliberately not a wire format, token, API, policy package, or
|
|
runtime resolver. Access-engine owns those representations and the
|
|
deterministic interpretation of the context alongside verified identity
|
|
claims, action, resource, approval, posture, and other policy inputs.
|
|
|
|
No field grants authority by being present. Caller assertion and authoritative
|
|
evidence must remain distinguishable, and security-critical resolution failure
|
|
fails closed.
|
|
|
|
## Consequences
|
|
|
|
- Access-engine has a stable semantic target without Gate House taking a
|
|
runtime position.
|
|
- Identity, tenancy, zone, and mandate sources remain owned by their respective
|
|
authorities; this contract only says what access-engine must be able to
|
|
express and bind.
|
|
- Transport-specific schemas may differ, but their mappings must preserve the
|
|
logical claims and invariants.
|
|
- New authorization-significant claims, modes, or semantic changes require a
|
|
new contract version and Gate House review.
|
|
- The obsolete Blueprint example remains historical input until GH-WP-0001-T05
|
|
revises that document; this contract is the current authority-context record.
|
|
|
|
## Alternatives rejected
|
|
|
|
### Publish a Gate House `/authorize` schema
|
|
|
|
Rejected because Gate House is Staff and holds no request-time position.
|
|
Owning an endpoint or executable decision schema here would contradict
|
|
GH-DEC-2026-001 and INV-02.
|
|
|
|
### Let each consumer infer the vocabulary
|
|
|
|
Rejected because principal/actor collapse, mode ambiguity, and unverified
|
|
caller context are precisely the semantic failures the doctrine must prevent.
|
|
|
|
### Put every claim into a credential
|
|
|
|
Rejected because credentials are implementation artifacts of authorization,
|
|
not the source of authority. The context need only remain linked across the
|
|
authoritative systems and decision evidence.
|
|
|