coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T02: draft-2 of the Service Identity and Privilege standard after the founder's review
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Applied the founder's four decisions: OpenBao platform-admin binds aal2 (SI-8 MUST);
the human administrator keeps directory admin rights through an admin group (SI-5);
declarations start in this repository and move to the services; agents get their own
class and rule SI-14. Finding F-1: the coding-agent role presents as a service against
IAM Profile v0.3. Schema, validator and tests follow (37 pass). Rehearsals listed, not
decided. Not ratified; owner review still open.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 22:50:01 +02:00
parent 48385816fd
commit ca03da52c6
8 changed files with 194 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/service-identity-inventory.md
View file

@ -84,7 +84,7 @@ Authelia has no local user store or admin UI in this configuration (LDAP backend
| OIDC role for credential-broker | human | Group `net-kingdom-admins` **and** `aal2` receive the credential-broker policy | `credential-broker-keycape-client-secret-generate-oidc-role.json` | Established |
| OIDC role for the fluid-telegram operators | human | Group `fluid-telegram-operators` and `aal2` | `fluid-telegram-hall-of-helix-oidc-role.json` | Established |
| JWT role `secrets-engine-openbao` | workload | Subject `service:secrets-engine`, scope `openbao:login`, policy `secrets-engine-login-self`, five-minute token | `secrets-engine-jwt-role.json` | Established |
| JWT role and AppRole for the coding agent | workload | Subject `service:codex:railiance-platform`; policies `agent-high-risk-boundary`, `workload-kv-read-issue-core-runtime`; fifteen minutes | `coding-agent-jwt-role.json`, `coding-agent-approle.json` | Established |
| JWT role and AppRole for the coding agent | agent (filed as workload in the first draft) | Subject `service:codex:railiance-platform`; policies `agent-high-risk-boundary`, `workload-kv-read-issue-core-runtime`; fifteen minutes | `coding-agent-jwt-role.json`, `coding-agent-approle.json` | Established |
| ESO roles, backup publisher and retention policies | workload | One policy per delivery, for example `net-kingdom-backup-publisher-eso` and `net-kingdom-backup-retention-eso` | `openbao/policies/` | Established as files; live roles **unknown** |
| Root grant, unseal shares | break-glass | Final authority | `tools/custody-record`, custody docs | Holders **unknown**; see the crisis custody list |
@ -111,7 +111,11 @@ repositories. They are **unknown** here and each owner must supply a declaration
credential-broker and fluid-telegram roles also require `aal2`. MFA is enforced earlier by
KeyCape (`requireForAll: true`), so this may be intended, but the policy should say whether
OpenBao must assert the assurance level itself. This is a question for T02, not a finding of a defect.
6. **The backup contains the admin password** (the `lldap-secrets` Secret). That is by design
6. **The coding agent presents as a service.** The OpenBao role for the coding agent binds `principal_type:
service`, while IAM Profile v0.3 requires agent tokens to carry `principal_type: agent` and to name the
agent's mode. This is finding F-1 in the standard (§8). The role's fifteen-minute token and its boundary
policy already fit the intent of SI-14.
7. **The backup contains the admin password** (the `lldap-secrets` Secret). That is by design
for recovery, and it is another reason the human and service uses must be separated.
## What must be confirmed