2026-09-15 00:35:14 +02:00
|
|
|
# Flex Auth policy request — compact sitting
|
|
|
|
|
|
|
|
|
|
Not admitted. Not a local allow. Not an expansion of the T03 three-record
|
|
|
|
|
mandate (`FLEX-WP-0027`, `examples/informed-decision-t03`).
|
|
|
|
|
|
2026-09-15 22:37:04 +02:00
|
|
|
Native objects exist for seven memos (2026-09-15T20:35Z). Compilable draft:
|
|
|
|
|
`policy-package.md`. `c01` is still omitted.
|
2026-09-15 00:35:14 +02:00
|
|
|
|
|
|
|
|
## Intended allow (same identity bar as T03)
|
|
|
|
|
|
|
|
|
|
- caller: `system:serviceaccount:informed-decision:review` via TokenReview
|
|
|
|
|
- subject: verified human, `tenant:platform`, group `net-kingdom-admins`,
|
|
|
|
|
KeyCape AAL2 MFA facts as in the T03 package
|
|
|
|
|
- actions: `read`, `acknowledge`, `accept`, `return`, `discuss`, `decline`
|
|
|
|
|
- deny every other resource id
|
|
|
|
|
- no consume, no approval create, no presentation claim as policy input
|
|
|
|
|
|
2026-09-15 22:37:04 +02:00
|
|
|
## Exact pins (from sitting-create receipt)
|
|
|
|
|
|
|
|
|
|
| resource.id | approval_id | Blocking record |
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
| `memo:infd-20260914-c02` | `ccfd8007-2061-48fd-9356-99b16279dac1` | RPF-WP-0035-T02 |
|
|
|
|
|
| `memo:infd-20260914-c03` | `a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f` | NK-WP-0032-T03 |
|
|
|
|
|
| `memo:infd-20260914-c04` | `22ac6df3-e6a9-472b-a68e-c8caca4289a7` | WARDEN-WP-0027-T02 |
|
|
|
|
|
| `memo:infd-20260914-d01` | `9f7c3506-68de-4826-86ff-e301f428408d` | CUST-WP-0038-T08 |
|
|
|
|
|
| `memo:infd-20260914-d02` | `b3ce2c01-0a3b-401e-b4ed-c1954af169c9` | HFACT-WP-0001-T03 |
|
|
|
|
|
| `memo:infd-20260914-d03` | `3b483e6b-0b92-45ff-83b6-bc5057c0a496` | MASON-WP-0005 plan |
|
|
|
|
|
| `memo:infd-20260914-d04` | `356e67a3-5539-46a1-922a-f5591fd38ee5` | RCLK-WP-0002-T01 |
|
|
|
|
|
|
|
|
|
|
`memo:infd-20260914-c01` is not in this package.
|
2026-09-15 00:35:14 +02:00
|
|
|
|
|
|
|
|
Owner: flex-auth. This repository drafts; it does not evaluate authorization.
|
