From 2438556edfaefdc63d1dcf6b7c5750569e87e494 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 24 Oct 2026 23:41:55 +0200 Subject: [PATCH] NK-WP-0054-T02: founder approved draft-3 in principle; ratification awaits two owner replies The founder accepted the SecurityCanon-profile approach and confirmed the platform-root and admin definitions. T02 now waits on railiance-platform (F-1, aal2) and security-canon (mode readings) before ratification as v0.1. The review decision is resolved. Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed --- canon/standards/service-identity-privilege_v0.1.md | 11 +++++++++-- workplans/NK-WP-0054-service-identity-policy.md | 10 +++++++--- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/canon/standards/service-identity-privilege_v0.1.md b/canon/standards/service-identity-privilege_v0.1.md index b390e48..ab3455d 100644 --- a/canon/standards/service-identity-privilege_v0.1.md +++ b/canon/standards/service-identity-privilege_v0.1.md @@ -30,7 +30,9 @@ related: ## 0. Status -**Proposed, draft-3.** It binds nothing until the founder ratifies it and each owner adopts it. +**Proposed, draft-3. Approved in principle by the founder on 2026-10-24.** It binds nothing until it is ratified +as v0.1 and each owner adopts it. Ratification awaits two owner replies: railiance-platform (finding F-1 and the +`aal2` binding, exceptions SI-X4 and F-1) and security-canon (confirmation of the mode readings in §3). - **draft-1** (2026-10-24): thirteen rules, naming, five initial exceptions, seven open questions. - **draft-2** (2026-10-24): the founder's review decided six points (§10), added the agent class and SI-14. @@ -259,6 +261,11 @@ changes the role or records an exception with a compensating control. ## 10. Decisions and open items +**Approved by the founder, 2026-10-24, on review of draft-3:** the profile approach (§1, §2); `platform-root` as +`SOVEREIGN @ platform` with `BREAK_GLASS` activation in production and build-mode `CONSTRUCT @ platform` in +`DEVELOPMENT` and `TEST` only; `admin` as `OPERATE @ platform`, `OPERATE @ backup-system` and `ADMINISTER @ directory` +through an admin group (§3). Ratification as v0.1 follows the owner replies named in §0. + **Decided by the founder, 2026-10-24:** 1. OpenBao `platform-admin` binds the `aal2` claim itself (SI-8). The change is railiance-platform's. @@ -268,7 +275,7 @@ changes the role or records an exception with a compensating control. 4. Agents are a distinct principal with SI-14; their token ceiling is 60 minutes. 5. `ld-admin` is for LLDAP only; `admin` stays the human's name on every service. -**Settled unless the founder objects:** KeyCape's confidential clients are governed by IAM Profile v0.3 plus a +**Settled with draft-3 (not objected to in review):** KeyCape's confidential clients are governed by IAM Profile v0.3 plus a declaration; the reserved-name rule applies to credential-holding accounts, not to federated roles. **New in draft-3, for the founder and the canon owners:** diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index 46839e6..9f24aec 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -76,10 +76,9 @@ id: NK-WP-0054-T02 status: wait priority: high assignee: claude-code -needs_human: true -decision_id: "a3582e79-4ece-4902-9bfa-e962aef2b8f2" depends_on: [NK-WP-0054-T01] -blocking_reason: "Draft-2 reflects the founder review of 2026-10-24 (four decisions). Await ratification and review by the service owners the inventory names." +blocked_on: message-from:railiance-platform +blocking_reason: "Founder approved draft-3 in principle on 2026-10-24. Ratification as v0.1 awaits replies from railiance-platform (hub message 8da287e2: F-1 and the aal2 binding) and security-canon (28998f18: mode readings)." state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f" ``` @@ -93,6 +92,11 @@ Profile v0.3, Credential Management v0.2 and the Security Zones standard. **Done when:** the draft is reviewed by the founder and the service owners it names. +Founder review of draft-3 completed 2026-10-24: profile approach accepted, `platform-root` and `admin` definitions +confirmed, approved in principle. What remains for **done** is the owners' side: railiance-platform and +security-canon replies (the other four hub messages, to state-hub, key-cape, glas-harness and emergent-security, are +recommendations and do not gate ratification). On their replies, set the standard's status to accepted and close T02. + Draft-3 (2026-10-24): realigned as an estate profile of SecurityCanon after a review against the canon (`history/2026-10-24-security-identity-and-agent-review.md`): imported vocabulary, SEC-DSM references per rule, estate identities in canon terms, new SI-15 (accountable automation). Validator migration is T03b.