NK-WP-0048-T08: identity-provisioner service-access groups ensure/revoke

POST /v1/groups/ensure and /v1/groups/revoke: reserved prefixes refused, no
user creation, validate-before-mutate, read-back before success, delete only
empty groups on request. The oidc-browser-relying-party type now names them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

security-case-types/oidc-browser-relying-party/README.md

@@ -80,8 +80,9 @@ confidential secrets from custody. That would be a 1.1 or 2.0 of this type.
 - No loopback or plain-http redirects (CLI and local development clients).
 - No resource `audience`, registration-bound `tenant` or custom scopes.
 - No service (`client_credentials`) clients: that is the `oidc-service-client` type.
-- Group creation assumes the identity-provisioner exposes `groups ensure`; until
-  it does, `ensure-groups` is the owner's open item (NK-WP-0048-T04).
+- Groups are service-access groups only: the identity-provisioner refuses
+  `tenant*`, `netkingdom-*` and `lldap_*` names on this path, and never creates
+  users (members must already exist).
 - `custody` uses the railiance-platform credential broker; that owner has not yet
   declared a `c3.runtime-secrets` capability, so `mint-secret` is a follow-through
   step rather than a composed capability. When it is declared, compose it.

security-case-types/oidc-browser-relying-party/type.yaml

@@ -124,8 +124,8 @@ spec:
   follow_through:
     - id: ensure-groups
       owner: net-kingdom
-      entry_point: "identity-provisioner groups ensure --groups {access_groups} --members '{initial_members}'"
-      auth: "NetKingdom identity-provisioner service identity with LLDAP group administration, via the ops-warden proxy"
+      entry_point: "identity-provisioner POST /v1/groups/ensure (groups {access_groups}; members {initial_members})"
+      auth: "identity-provisioner service token (bearer), via the ops-warden proxy; the provisioner holds the LLDAP admin credential"
       warden_executes: true
       attended: false
     - id: mint-secret
@@ -187,7 +187,7 @@ spec:
       when: "client_type == confidential"
       action: "destroy the secret at {secret_ref}"
     - reverses: ensure-groups
-      action: "remove the case's initial memberships; delete groups {access_groups} only if this case created them and no other case uses them"
+      action: "identity-provisioner POST /v1/groups/revoke with the case's memberships; delete_if_empty only if no other case uses {access_groups}"
     - reverses: client-secret-path
       when: "client_type == confidential"
       action: "remove the KV path {secret_ref}"