NK-WP-0054-T05: svc-provisioner in lldap_admin under exception SI-X6 (founder decision)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

tools/service-identity/declarations/lldap.yaml

@@ -81,8 +81,8 @@ identities:
     status: planned
   - name: svc-provisioner
     principal_type: SERVICE
-    purpose: "Target: identity-provisioner, narrowest working write scope for users and groups, not the super-admin (scope to be tested)"
-    grants: [{mode: ADMINISTER, scope: "directory/people,groups", activation: STANDING, environments: [PRODUCTION]}]
+    purpose: "Target: identity-provisioner; member of lldap_admin, the narrowest LLDAP group that can create users (rehearsal 2026-10-28)"
+    grants: [{mode: ADMINISTER, scope: directory, activation: STANDING, environments: [PRODUCTION], note: "lldap_admin; exception SI-X6"}]
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -99,3 +99,11 @@ exceptions:
     expires: 2027-01-31
     compensating_control: "Web UI restricted by IP allowlist; OTP on the human login"
     elimination_path: "NK-WP-0054-T05: svc-* binds, a provisioner account, ld-admin as the configured super-admin, admin human-only"
+  - id: SI-X6
+    rules: [SI-3]
+    identity: svc-provisioner
+    reason: "LLDAP v0.6.2 has no group narrower than lldap_admin that can create users or add members"
+    owner: "Founder"
+    expires: 2027-04-30
+    compensating_control: "Own account and Secret, used only by identity-provisioner; web UI restricted by IP allowlist"
+    elimination_path: "A narrower LLDAP role, or a provisioner that no longer creates users"