coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/INTENT.md
tegwick 892149a7b5 Point layering note at the published standard 
The layer model is now published as
net-kingdom/canon/standards/security-layer-model_v0.1.md (proposed) and
ratified by gate-house GH-DEC-2026-001. The note previously said the
standard was not yet written.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
2026-08-28 21:21:07 +02:00

4.4 KiB
Raw Blame History

INTENT

NetKingdom layering review — 2026-08-28. This repository's role was reviewed against the NetKingdom IT-security layer model: Taxonomy → Tooling → Engines → Staff, layered by determinism and by the kind of artifact each layer produces. Findings and the argument behind them: gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md. The model is net-kingdom/canon/standards/security-layer-model_v0.1.md (proposed), ratified by gate-house/decisions/decisions.md GH-DEC-2026-001.

The layer rule that binds every repository: Staff never touches tooling directly. It acts only through engine APIs.

This repository is Tooling — deterministic infrastructure and state. State the layer: key-cape packages the third-party identity tooling (authelia, lldap, privacy-idea) behind a versioned IAM profile. It owns authentication and identity claims only. Because "auth" is ambiguous across the estate, this INTENT should say explicitly that key-cape is not an authorization decision point — that is access-engine's, and it stays the only one.

This note records what should change. The body below is not yet adapted.

Purpose

This repository exists to provide a lightweight, profile-conformant identity and access management (IAM) system.

It ensures that applications can rely on a stable, versioned authentication contract independent of the underlying IAM implementation.

Primary Utility

The repository provides an implementation of a versioned IAM profile that:

  • Delivers OIDC/PKCE-based authentication with strong security constraints
  • Normalizes identity data across heterogeneous backend systems
  • Enforces strict adherence to the defined IAM contract
  • Enables seamless migration between lightweight and expanded IAM modes

It transforms IAM from a system dependency into a replaceable, contract-driven capability.

Intended Users

  • Application developers integrating against the IAM profile
  • Infrastructure operators (adm) deploying IAM in constrained environments
  • Automation systems (atm) managing identity, migration, and validation workflows
  • LLM agents (agt) interacting with authenticated services

Strategic Role in the System

This repository serves as the lightweight IAM layer:

  • It provides a resource-efficient implementation of the IAM profile for environments with limited resources

  • It anchors IAM around a profile contract rather than a specific implementation

  • It enables a two-mode architecture:

    • Lightweight mode (this implementation)
    • Expanded mode (a heavier, full-featured implementation)

The profile ensures that both modes are interchangeable without application changes.

Strategic Boundaries

This repository is not intended to:

  • Become a full-featured, general-purpose IAM platform
  • Extend beyond the defined IAM profile
  • Support features that weaken security guarantees (e.g., implicit flow, wildcard redirects)
  • Replace or wrap the heavier expanded-mode implementation

Its responsibility is limited to strict, secure, and transparent profile implementation.

Design Principles

  • Contract over implementation Applications depend on the IAM profile, not on KeyCape internals

  • Security through constraint Only explicitly allowed features are supported; unsafe patterns are rejected

  • Explicitness over convenience Unsupported features must fail clearly and predictably

  • Replaceability by design The system must be swappable with a heavier profile implementation without breaking integrations

  • Canonical identity model Identity data must be normalized and consistent across all backends

Maturity Target

A mature version of this repository should:

  • Fully implement and enforce the IAM profile with zero ambiguity
  • Provide complete migration pathways between lightweight and expanded modes
  • Offer deterministic and testable behavior across all supported scenarios
  • Act as a reference implementation of the IAM profile
  • Enable IAM deployments that are minimal, secure, and operationally efficient

Stability Note

Changes to this file represent a deliberate shift in the IAM contract, scope, or architectural role of this repository.

Such changes must be made with explicit intent, as they directly affect all dependent applications.