schema_version: "0.1"
service: bounded-executor
owner: "NetKingdom (executor source); runtime package rapp-bounded-executor (NK-WP-0056-T02, founder decision 6d1adce9)"
declared_at: 2026-10-31
attestation:
  authored_by: claude-code
  basis: [canon/standards/bounded-execution-admission_v0.1.md, examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml, sso-mfa/k8s/bounded-executor/rbac.yaml, workplans/NK-WP-0056-bounded-executor-path.md]
  owner_confirmed: false
complete: false
# Every credential the bounded executor holds carries executor_subject service:nk-bind-executor, the identity
# its admissions name. Together they are its declared authority; `validate.py --admissions` checks that an
# admission's scope ceiling lies inside them. All grants are APPROVED: they act only during a consumed
# admission (SI-15). Pilot scope (T06): rotate the svc-authelia bind, one consumer.
identities:
  - name: nk-bind-executor
    principal_type: WORKLOAD
    conventions: [executor]
    executor_subject: "service:nk-bind-executor"
    purpose: "Kubernetes ServiceAccount sso/nk-bind-executor: force-sync the authelia-secrets ExternalSecret and restart the authelia Deployment; no Secret read"
    grants:
      - {mode: OPERATE, scope: k8s/sso/deployment/authelia, activation: APPROVED, environments: [PRODUCTION], note: "Role: get, watch, patch on deployments/authelia"}
      - {mode: OPERATE, scope: k8s/sso/externalsecret/authelia-secrets, activation: APPROVED, environments: [PRODUCTION], note: "Role: get, patch on externalsecrets/authelia-secrets"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: bounded-executor, kind: service}]
    owner: "NetKingdom"
    rotation: {path: "Projected ServiceAccount token, short-lived; nothing to rotate by hand", coupling: [bounded-executor]}
    status: planned
  - name: net-kingdom-bounded-executor
    principal_type: WORKLOAD
    conventions: [executor]
    executor_subject: "service:nk-bind-executor"
    purpose: "OpenBao Kubernetes-auth role for sso/nk-bind-executor (CCR-2026-0058, approved, window-scoped): write the next version of the svc-authelia bind (CAS) and read it; holding the current value is what lets the executor change the bind's own password in LLDAP"
    grants:
      - {mode: OPERATE, scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "KV data read and CAS write; 15 min TTL; role exists only in the admitted window (CCR-2026-0058)"}
      - {mode: OPERATE, scope: lldap/people/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "self-rotation: signs in as the bind with the KV value and changes its own password (hub 3d0c8f86)"}
    interactive_login: false
    second_factor: not_applicable
    custody: [openbao-lease]
    consumers: [{name: bounded-executor, kind: service}]
    owner: "railiance-platform (OpenBao role) for NetKingdom"
    rotation: {path: "OpenBao lease per run; no standing secret", coupling: [bounded-executor]}
    status: planned
  - name: svc-executor-read
    principal_type: SERVICE
    conventions: [bind]
    executor_subject: "service:nk-bind-executor"
    purpose: "Read-only directory bind for plan and verify steps (users, groups, bind identities); replaces the founder signing in as admin for reads"
    grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
    interactive_login: false
    second_factor: not_applicable
    custody: [openbao-lease]
    consumers: [{name: bounded-executor, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Bind password in OpenBao, rotated by the executor itself under an admission", coupling: [bounded-executor]}
    status: planned
  - name: svc-executor-admin
    principal_type: SERVICE
    conventions: [executor]
    executor_subject: "service:nk-bind-executor"
    purpose: "lldap_admin, only for root-class steps (create svc-* accounts, change the configured super-admin) under a high-risk admission; how membership is granted per run and removed afterwards is open"
    grants:
      - {mode: ADMINISTER, scope: lldap, activation: APPROVED, environments: [PRODUCTION], note: "root-class only; no narrower LLDAP group (SI-X6)"}
    interactive_login: false
    second_factor: not_applicable
    custody: [openbao-lease]
    consumers: [{name: bounded-executor, kind: service}]
    owner: "NetKingdom directory and User Engine owners"
    rotation: {path: "Per-run activation to be designed; not part of the T06 pilot", coupling: [bounded-executor]}
    status: planned