# INTENT

> **NetKingdom layering review — 2026-08-28.** This repository's role was reviewed
> against the NetKingdom IT-security layer model: **Taxonomy → Tooling → Engines →
> Staff**, layered by determinism and by the kind of artifact each layer produces.
> Findings and the argument behind them:
> `gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md`.
> The model is `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed),
> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001.
>
> The layer rule that binds every repository: **Staff never touches tooling
> directly. It acts only through engine APIs.**
>
> **This repository is Tooling — deterministic infrastructure and state.** State the layer: key-cape packages the third-party identity tooling (authelia, lldap, privacy-idea) behind a versioned IAM profile. It owns authentication and identity claims only. Because "auth" is ambiguous across the estate, this INTENT should say explicitly that key-cape is **not** an authorization decision point — that is access-engine's, and it stays the only one.
>
> *This note records what should change. The body below is not yet adapted.*

## Purpose

This repository exists to provide a **lightweight, profile-conformant identity and access management (IAM) system**.

It ensures that applications can rely on a **stable, versioned authentication contract** independent of the underlying IAM implementation.

---

## Primary Utility

The repository provides an implementation of a **versioned IAM profile** that:

* Delivers OIDC/PKCE-based authentication with strong security constraints
* Normalizes identity data across heterogeneous backend systems
* Enforces strict adherence to the defined IAM contract
* Enables seamless migration between lightweight and expanded IAM modes

It transforms IAM from a system dependency into a **replaceable, contract-driven capability**.

---

## Intended Users

* Application developers integrating against the IAM profile
* Infrastructure operators (`adm`) deploying IAM in constrained environments
* Automation systems (`atm`) managing identity, migration, and validation workflows
* LLM agents (`agt`) interacting with authenticated services

---

## Strategic Role in the System

This repository serves as the **lightweight IAM layer**:

* It provides a **resource-efficient implementation** of the IAM profile for environments with limited resources
* It anchors IAM around a **profile contract rather than a specific implementation**
* It enables a **two-mode architecture**:

  * Lightweight mode (this implementation)
  * Expanded mode (a heavier, full-featured implementation)

The profile ensures that both modes are **interchangeable without application changes**.

---

## Strategic Boundaries

This repository is **not** intended to:

* Become a full-featured, general-purpose IAM platform
* Extend beyond the defined IAM profile
* Support features that weaken security guarantees (e.g., implicit flow, wildcard redirects)
* Replace or wrap the heavier expanded-mode implementation

Its responsibility is limited to **strict, secure, and transparent profile implementation**.

---

## Design Principles

* **Contract over implementation**
  Applications depend on the IAM profile, not on KeyCape internals

* **Security through constraint**
  Only explicitly allowed features are supported; unsafe patterns are rejected

* **Explicitness over convenience**
  Unsupported features must fail clearly and predictably

* **Replaceability by design**
  The system must be swappable with a heavier profile implementation without breaking integrations

* **Canonical identity model**
  Identity data must be normalized and consistent across all backends

---

## Maturity Target

A mature version of this repository should:

* Fully implement and enforce the **IAM profile** with zero ambiguity
* Provide **complete migration pathways** between lightweight and expanded modes
* Offer **deterministic and testable behavior** across all supported scenarios
* Act as a **reference implementation** of the IAM profile
* Enable IAM deployments that are **minimal, secure, and operationally efficient**

---

## Stability Note

Changes to this file represent a **deliberate shift in the IAM contract, scope, or architectural role** of this repository.

Such changes must be made with explicit intent, as they directly affect all dependent applications.