From 72b0eb404c3448698310dc21aa69136782387cf9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 29 Jul 2026 21:33:37 +0200 Subject: [PATCH] Record platform-root authorization fix --- workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md index 3fd9ba0..4db0aa1 100644 --- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md +++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md @@ -156,6 +156,13 @@ directory login, replay denial, and cleanup. This task now awaits only the Binky user's own password choice, MFA enrollment, and final scoped-token acceptance. +2026-07-29: the first portal attempt correctly denied cross-tenant access +because KeyCape had not projected the established `net-kingdom-admins` group +to the new platform-operator role. Commit `90a2078` adds and tests the explicit +`tenant:platform` / `platform-operator` compatibility mapping and is deployed +Ready. The operator must start a fresh OIDC session so the corrected claims +are minted. + ## Task: Register a workload-identity OIDC client for the qonto runtime ```task