From 3710894120a5c3f5f3920de2d569a0fdc35fd2e8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 29 Jul 2026 21:33:31 +0200 Subject: [PATCH] Record platform-root claim correction --- .../NK-WP-0023-user-engine-portal-platform-integration.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md index 0bb90a8..0cf51b1 100644 --- a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md +++ b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md @@ -100,6 +100,13 @@ The helper image is digest-pinned and the service is non-root, read-only, and NetworkPolicy restricted. Binky's user-chosen password and MFA acceptance remain. +2026-07-29 correction: live platform-root access exposed that the established +`net-kingdom-admins` bootstrap group was not mapped into the newer IAM +envelope. KeyCape `90a2078` now maps that group explicitly to +`tenant:platform` plus `platform-operator`, with regression coverage, while +tenant-admin mappings remain tenant scoped. The fixed image is Ready on +railiance01. + ## T04 - Integrate authorization, email, audit, and events ```task