coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T04: KeyCape client scopes declared from key-cape source (a1ab8ff)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 09:53:35 +01:00
parent 81422e3d66
commit 49eb79e267
2 changed files with 18 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tools/service-identity/declarations/keycape.yaml
View file

@ -23,10 +23,10 @@ identities:
status: active
- name: secrets-engine-approval
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
- {mode: USE, scope: "approval-engine: approval:read, approval:consume", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff service-clients.example.yaml L27-39, token.go:355-363"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -36,10 +36,10 @@ identities:
status: active
- name: secrets-engine-requester
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
- {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L106-119; subject lacks service: prefix"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -49,10 +49,10 @@ identities:
status: active
- name: approval-engine-operator
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
- {mode: OPERATE, scope: "approval-engine: approval:create, read, approve, revoke, supersede, observe, emit", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L57-69; withdrawn 2026-09-09, still registered; SI-11 retirement candidate"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -62,10 +62,10 @@ identities:
status: active
- name: informed-decision-sitting-requester
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
- {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -78,7 +78,7 @@ identities:
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
- {mode: unknown, scope: "token scopes", note: "reference config: rapp-qonto-client, qonto:read; confirm live (KEY-WP-0045-T02)"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]