NK-WP-0054-T02: Service Identity and Privilege standard ratified as v0.1
The founder ratified the standard (status accepted) on 2026-10-25 and accepted the emergent-security start card 0.2.7. Ratification applies no exception's elimination path, changes no live service and does not make any declaration owner-confirmed. T02 done. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
parent
d0f259b12c
commit
2de259a46d
6 changed files with 29 additions and 17 deletions
|
|
@ -309,7 +309,7 @@
|
|||
| task | NK-WP-0053-T03 | wait | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
|
||||
| task | NK-WP-0053-T04 | todo | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
|
||||
| task | NK-WP-0054-T01 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T02 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T02 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T03 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T04 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T05 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
|
|
|
|||
|
|
@ -3,14 +3,14 @@ id: netkingdom-service-identity-privilege
|
|||
type: standard
|
||||
title: "NetKingdom Service Identity and Privilege v0.1"
|
||||
domain: netkingdom
|
||||
status: proposed
|
||||
status: accepted
|
||||
version: "0.1"
|
||||
created: "2026-10-24"
|
||||
updated: "2026-10-24"
|
||||
updated: "2026-10-25"
|
||||
scope: service-account-governance
|
||||
revision: "draft-4"
|
||||
revision: "v0.1"
|
||||
owner: net-kingdom
|
||||
last_reviewed: "2026-10-24"
|
||||
last_reviewed: "2026-10-25"
|
||||
review_interval: 3m
|
||||
standard_token: service-identity-privilege_v0.1
|
||||
profiles:
|
||||
|
|
@ -30,9 +30,12 @@ related:
|
|||
|
||||
## 0. Status
|
||||
|
||||
**Proposed, draft-4 (draft-3 approved in principle by the founder on 2026-10-24).** It binds nothing until it is ratified
|
||||
as v0.1 and each owner adopts it. Both owner replies are in (§10); ratification as v0.1 awaits the founder's decision on the corrections they
|
||||
produced.
|
||||
**Accepted, v0.1. Ratified by the founder on 2026-10-25.** The text is draft-4, unchanged by ratification: the
|
||||
founder approved draft-3 in principle on 2026-10-24, both owner replies arrived the same day (security-canon and
|
||||
railiance-platform; §10), and the corrections they produced were applied before ratification. Ratifying the
|
||||
standard does not apply any exception's elimination path, change any live service, or make a declaration
|
||||
owner-confirmed; each service owner still adopts it on their own schedule, and the declarations stay
|
||||
`owner_confirmed: false` until they do.
|
||||
|
||||
- **draft-1** (2026-10-24): thirteen rules, naming, five initial exceptions, seven open questions.
|
||||
- **draft-2** (2026-10-24): the founder's review decided six points (§10), added the agent class and SI-14.
|
||||
|
|
|
|||
|
|
@ -95,3 +95,11 @@ people accept. The founder is asked to accept or withdraw the card.
|
|||
`fix-consistency` where it would have touched another job's uncommitted files.
|
||||
|
||||
Draft-4 of the standard applies the security-canon corrections and records the others; no founder decision changed.
|
||||
|
||||
## Founder decisions, 2026-10-25
|
||||
|
||||
- **Ratified** `canon/standards/service-identity-privilege_v0.1.md` as v0.1 (status accepted).
|
||||
- **Accepted** the emergent-security start card 0.2.7 (commit `8c903af`, digest
|
||||
`22b7294e24137c0a350764b9cf37f3d4f2e9f35eb7c97a287d9c89477ef24d7a`) after reading the diff of the card text. The
|
||||
acceptance is a human review of an agent-prepared change, recorded here and sent to emergent-security for its
|
||||
EMERGENT-WP-0002 tracking. That commit is still local to that repository and is not pushed by net-kingdom.
|
||||
|
|
|
|||
|
|
@ -2,9 +2,9 @@
|
|||
|
||||
NK-WP-0054-T03. Offline and read-only. Checks declarations against
|
||||
`canon/schemas/service-identity_v0.1.schema.json` and evaluates the rules of the
|
||||
proposed [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
|
||||
accepted [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
|
||||
that a declaration alone can decide. It was built against draft-1, before the founder's review,
|
||||
so a rule change in the standard changes this tool. It follows draft-3.
|
||||
so a rule change in the standard changes this tool. It follows the accepted v0.1 text (draft-4).
|
||||
|
||||
```bash
|
||||
make service-identity-test # unit tests
|
||||
|
|
|
|||
|
|
@ -2,10 +2,10 @@
|
|||
# /// script
|
||||
# dependencies = ["jsonschema>=4.10,<5", "PyYAML>=6,<7"]
|
||||
# ///
|
||||
"""Check service identity declarations against the proposed standard (NK-WP-0054-T03).
|
||||
"""Check service identity declarations against the accepted standard (NK-WP-0054-T03).
|
||||
|
||||
Validates `canon/schemas/service-identity_v0.1.schema.json`, then evaluates the rules of
|
||||
NetKingdom Service Identity and Privilege v0.1 (draft-3, a SecurityCanon profile) that a declaration alone can decide.
|
||||
NetKingdom Service Identity and Privilege v0.1 (v0.1, a SecurityCanon profile) that a declaration alone can decide.
|
||||
Each identity ends as `conformant`, `non-conformant`, `excepted` or `unknown`; unknown is a
|
||||
finding, not a pass. Observed state is the health check's job (T04), not this tool's.
|
||||
|
||||
|
|
@ -98,7 +98,7 @@ NON_HUMAN = {"SERVICE", "WORKLOAD", "AGENT", "CONTROLLER", "DEVICE"}
|
|||
|
||||
|
||||
def _violations(identity: dict[str, Any]) -> tuple[set[str], list[str]]:
|
||||
"""Rules broken by one account on declared facts, and the facts still unknown (standard draft-3)."""
|
||||
"""Rules broken by one account on declared facts, and the facts still unknown (standard v0.1)."""
|
||||
broken: set[str] = set()
|
||||
unknown: list[str] = []
|
||||
principal = identity["principal_type"]
|
||||
|
|
|
|||
|
|
@ -73,13 +73,10 @@ is an uninventoried legacy admin, and OpenBao `platform-admin` binds on a group
|
|||
|
||||
```task
|
||||
id: NK-WP-0054-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0054-T01]
|
||||
needs_human: true
|
||||
decision_id: "c926a190-8614-40b8-a20f-b017ef728db2"
|
||||
blocking_reason: "Both owner replies are in (security-canon, railiance-platform). Draft-4 applies them. Await the founder's ratification of v0.1 and answers to the post-review choices in the decision."
|
||||
state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f"
|
||||
```
|
||||
|
||||
|
|
@ -104,6 +101,10 @@ glas-harness and state-hub assessed the agent and attribution gaps (KEY-WP-0043,
|
|||
Draft-4 of the standard applies all of it without changing a founder decision. What remains for T02 is ratification:
|
||||
set the status to accepted when the founder decides.
|
||||
|
||||
Completed 2026-10-25: the founder ratified the standard as v0.1 (status accepted). Ratification applies no exception's
|
||||
elimination path and changes no live service; owners adopt on their own schedule and the declarations stay
|
||||
unconfirmed until they do.
|
||||
|
||||
Draft-3 (2026-10-24): realigned as an estate profile of SecurityCanon after a review against the canon
|
||||
(`history/2026-10-24-security-identity-and-agent-review.md`): imported vocabulary, SEC-DSM references per rule,
|
||||
estate identities in canon terms, new SI-15 (accountable automation). Validator migration is T08.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue