NK-WP-0054-T05: svc-provisioner in lldap_admin under exception SI-X6 (founder decision)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

canon/standards/service-identity-privilege_v0.1.md

@@ -292,6 +292,7 @@ DSM-EXC-001 binds violations of a canon MUST; an exception against a rule that i
 | SI-X2 | SI-10 | LDAP bind accounts | Static long-lived credential; LDAP has no lease | Governed residual secret (DSM-TRANS-002) until a federated directory lookup exists |
 | SI-X3 | naming, SI-11 | `trigger-admin` (privacyIDEA) | Legacy account, consumers uninventoried | NK-WP-0049-T22 deleted the unreferenced Kubernetes copy (2026-10-27); revoking the privacyIDEA account stays under CUST-WP-0073-T05 / NK-WP-0055-T06 |
 | SI-X5 | SI-4, SI-5 | privacyIDEA | Only a local administrator is supported | Upstream support for attributed administrators |
+| SI-X6 | SI-3 | LLDAP `svc-provisioner` | LLDAP v0.6.2 has no group narrower than `lldap_admin` that can create users or add members (rehearsal 2026-10-28); own account and Secret, but super-admin rights | A narrower LLDAP role, or a provisioner that no longer creates users (founder decision 2026-10-28) |
 
 **Closed:** SI-X4 (OpenBao `netkingdom-platform-admin` bound the group claim only) closed 2026-10-27: the founder applied the
 `aal2` binding (RPF-WP-0065-T04; receipts show `bound_claims` = `net-kingdom-admins` plus `/assurance/level: aal2`, and a

tools/service-identity/declarations/lldap.yaml

@@ -81,8 +81,8 @@ identities:
     status: planned
   - name: svc-provisioner
     principal_type: SERVICE
-    purpose: "Target: identity-provisioner, narrowest working write scope for users and groups, not the super-admin (scope to be tested)"
-    grants: [{mode: ADMINISTER, scope: "directory/people,groups", activation: STANDING, environments: [PRODUCTION]}]
+    purpose: "Target: identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)"
+    grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}]
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -99,3 +99,11 @@ exceptions:
     expires: 2027-01-31
     compensating_control: "Web UI restricted by IP allowlist; OTP on the human login"
     elimination_path: "NK-WP-0054-T05: svc-* binds, a provisioner account, ld-admin as the configured super-admin, admin human-only"
+  - id: SI-X6
+    rules: [SI-3]
+    identity: svc-provisioner
+    reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members"
+    owner: "Founder"
+    expires: 2027-04-30
+    compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist"
+    elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users"

workplans/NK-WP-0054-service-identity-policy.md

@@ -286,6 +286,9 @@ prompt or fd) plus the backup profile and the restore adapters `isolated-lldap.p
 `isolated-authelia.py`, `isolated-privacyidea-mfa.py`; **(4)** the founder runbook with filled-in
 commands, a founder-run rehearsal on a restored backup, then the live run.
 
+2026-10-28 founder decision: `svc-provisioner` gets its own account in `lldap_admin`, recorded as
+exception SI-X6 (SI-3, expires 2027-04-30) in the standard and `declarations/lldap.yaml`.
+
 ## Disposition of per-service admin accounts
 
 ```task