# KeyCape service client for the bounded executor's approval calls (NK-WP-0056-T06 prerequisite).
# The case of record; identical parameters to the type's first example. Accepted by the founder 2026-11-04
# (type acceptance: owner and founder; hub decision 59d570ef). Materialized 2026-11-04: its OpenBao structure
# is live (CCR-2026-0060/0061 applied, railiance-platform 9f22244). Going live makes oidc-service-client 0.2 `implemented`.
apiVersion: netkingdom.io/security-case/v0.1
kind: SecurityCase
spec:
  id: nk-bind-executor-approval
  type: oidc-service-client@0.2
  status: materialized
  acceptance:
    at: "2026-11-04"
    record: "Founder accepted the case as proposed in session 2026-11-04 (NK-WP-0056-T06; hub decision 59d570ef)"
    by:
      - {role: owner, name: founder}
      - {role: founder, name: founder}
  owner:
    repo: net-kingdom
    person: founder
  parameters:
    client_id: nk-bind-executor-approval
    display_name: NetKingdom bounded executor (approval-engine)
    audience: approval-engine
    allowed_scopes: approval:create,approval:read,approval:consume
    service_subject: service:nk-bind-executor
    tenant: tenant:platform
    roles: bounded-executor
    token_lifetime: 15m
    consuming_service: bounded-executor
    consumer_namespace: sso
    consumer_service_account: nk-bind-executor
    consumer_owner_repo: rapp-bounded-executor