# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
kind: BoundedExecutionAdmission
spec:
  id: BEA-2026-0002
  title: Create the service bind accounts (bind-split step 3, root-class)
  purpose: 'Create svc-authelia, svc-keycape and svc-privacyidea in LLDAP as read-only binds. Needs lldap_admin: LLDAP has
    no narrower grant that can create users (SI-X6), so the founder admits this run and the executor runs it.'
  work_ref: NK-WP-0056-T01 example
  risk_class: high
  window:
    not_before: '2026-11-03T09:00:00Z'
    not_after: '2026-11-03T12:00:00Z'
  approval:
    approvers:
    - admin
    principal_type: HUMAN
    assurance: aal2
    carriers:
    - approval-engine
    - founder-ssh-signature
  executor:
    identity: service:nk-bind-executor
    principal_type: WORKLOAD
    runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
  scope_ceiling:
  - mode: ADMINISTER
    scope: lldap
    environments: &id001
    - PRODUCTION
  - mode: OPERATE
    scope: openbao/platform/workloads/net-kingdom/directory-binds
    environments: *id001
  blast_radius:
    unit: account
    consumers:
    - lldap
    max_concurrent: 1
  trust_requires:
  - runtime_secret_trust
  - runtime_identity_trust
  plan:
    source:
      repo: net-kingdom
      commit: 15c9cdbef881
      files:
      - path: sso-mfa/k8s/lldap/bind-split.py
        sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
      - path: tools/service-binds/bind-lane.py
        sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
    steps:
    - id: create-accounts
      operation: lldap.user.create-read-only-binds
      target: lldap:svc-authelia,svc-keycape,svc-privacyidea
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: ADMINISTER
        scope: lldap
      checks_after:
      - accounts-read-only
      revert: delete-accounts
    - id: hold-passwords
      operation: openbao.kv.write-cas0
      target: openbao:platform/workloads/net-kingdom/directory-binds
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: OPERATE
        scope: openbao/platform/workloads/net-kingdom/directory-binds
      checks_after:
      - accounts-sign-in
      revert: destroy-kv
    revert_steps:
    - id: delete-accounts
      operation: lldap.user.delete-created
      target: lldap:svc-authelia,svc-keycape,svc-privacyidea
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: ADMINISTER
        scope: lldap
      checks_after:
      - accounts-read-only
    - id: destroy-kv
      operation: openbao.kv.destroy-created
      target: openbao:platform/workloads/net-kingdom/directory-binds
      consumer: lldap
      class: root-class
      mutates: true
      requires:
        mode: OPERATE
        scope: openbao/platform/workloads/net-kingdom/directory-binds
      checks_after:
      - accounts-sign-in
  plan_digest: sha256:0005f239aa3f917eff68557f2124180d13e086adb8ead70a59b6c0168f241f87
  checks:
  - id: accounts-read-only
    description: each account exists in lldap_strict_readonly only and cannot write
    ref: sso-mfa/k8s/lldap/bind-split.py
    sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
    timeout_seconds: 60
    expect: pass
  - id: accounts-sign-in
    description: each KV value signs in to LLDAP as its account
    ref: tools/service-binds/bind-lane.py
    sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
    timeout_seconds: 60
    expect: pass
  stop_and_revert:
    on_check_failure: revert
    on_budget_exhausted: revert
    on_unknown: stop
    on_revert_failure: stop-and-alert
    alert: founder via State Hub message
  budget:
    wall_time_seconds: 900
    attempts: 1
    cost:
      compute_cpu_seconds: 60
      egress_bytes: 1000000
      currency: EUR
      amount: 0.02
  consumption:
    single_use: true
    consume_before_first_step: true
  receipt:
    schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
    emit_to: audit-core
    retain: by-hash-no-secret-values
    independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
  not_authorized:
  - switching any consumer to the new accounts
  - any human account
  - changing LLDAP's configured super-admin