coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T02: draft-1 of the Service Identity and Privilege standard
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Thirteen rules (one identity one class, people and services never share a
credential, read-only per-service bind identities, one service-admin per
service, break-glass is not routine, assurance on privileged roles, custody
class, declaration, recovery, validation run by the operator identity), naming
svc-<service> and <short>-admin, five initial exceptions and six open questions.
Proposed; extends IAM Profile v0.3 and Credential Management v0.2. Hub decision
routes the review.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 20:02:30 +02:00
parent 597ffbf111
commit 768e7252e8
3 changed files with 241 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -73,10 +73,13 @@ is an uninventoried legacy admin, and OpenBao `platform-admin` binds on a group
```task
id: NK-WP-0054-T02
status: todo
status: wait
priority: high
assignee: claude-code
needs_human: true
decision_id: "a3582e79-4ece-4902-9bfa-e962aef2b8f2"
depends_on: [NK-WP-0054-T01]
blocking_reason: "Draft-1 delivered 2026-10-24. Await the founder review and answers to the six open questions in section 10."
state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f"
```
@ -90,6 +93,12 @@ Profile v0.3, Credential Management v0.2 and the Security Zones standard.
**Done when:** the draft is reviewed by the founder and the service owners it names.
Draft-1 delivered 2026-10-24: `canon/standards/service-identity-privilege_v0.1.md` (proposed). Thirteen
rules (SI-1 to SI-13), naming, a target shape for today's services, the declaration fields, the
conformance result states, five initial exceptions (SI-X1 to SI-X5) and six open questions. It
extends IAM Profile v0.3 and Credential Management v0.2 without changing either. Review is the
founder's, then the service owners named in the inventory.
## Schema and offline conformance validator
```task