schema_version: "0.1"
service: openbao
owner: "railiance-platform"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [railiance-platform openbao/auth/netkingdom-platform-admin-role.json, railiance-platform openbao/auth/credential-broker-keycape-client-secret-generate-oidc-role.json, railiance-platform openbao/auth/secrets-engine-jwt-role.json, railiance-platform openbao/auth/coding-agent-jwt-role.json, railiance-platform openbao/auth/fluid-telegram-hall-of-helix-oidc-role.json]
  owner_confirmed: false
complete: false
identities:
  - name: netkingdom-platform-admin
    principal_type: HUMAN
    federated_role: true
    purpose: "OIDC role: group net-kingdom-admins receives policies platform-admin and operator-custody, one-hour token"
    grants: [{mode: ADMINISTER, scope: openbao, activation: STANDING, environments: [PRODUCTION]}]
    assurance_claim_bound: true
    interactive_login: true
    second_factor: required
    custody: [none]
    consumers: [{name: members of net-kingdom-admins, kind: person}]
    owner: "railiance-platform"
    rotation: {path: "Federated; membership and policy change by reviewed change", coupling: []}
    status: active
    recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
  - name: credential-broker-keycape-client-secret-generate
    principal_type: HUMAN
    federated_role: true
    purpose: "OIDC role: net-kingdom-admins with aal2 may generate a KeyCape client secret in custody"
    grants: [{mode: ADMINISTER, scope: "openbao/platform/workloads/keycape", activation: STANDING, environments: [PRODUCTION]}]
    assurance_claim_bound: true
    interactive_login: true
    second_factor: required
    custody: [none]
    consumers: [{name: members of net-kingdom-admins, kind: person}]
    owner: "railiance-platform"
    rotation: {path: "Federated; policy change by reviewed change", coupling: []}
    status: active
  - name: fluid-telegram-operators
    principal_type: HUMAN
    federated_role: true
    purpose: "OIDC role: fluid-telegram operators with aal2"
    grants: [{mode: OPERATE, scope: "kv: fluid-telegram/hall-of-helix, 4 exact entries", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: create/read/update, no list/delete; TTL 15m, max 30m"}]
    assurance_claim_bound: true
    interactive_login: true
    second_factor: required
    custody: [none]
    consumers: [{name: members of fluid-telegram-operators, kind: person}]
    owner: "railiance-platform"
    rotation: {path: "Federated; policy change by reviewed change", coupling: []}
    status: active
  - name: secrets-engine-openbao
    principal_type: SERVICE
    federated_role: true
    purpose: "JWT role: subject service:secrets-engine, scope openbao:login, policy secrets-engine-login-self, five-minute token"
    grants: [{mode: USE, scope: openbao, activation: STANDING, environments: [PRODUCTION], note: "login-self only"}]
    interactive_login: false
    second_factor: not_applicable
    custody: [none]
    consumers: [{name: secrets-engine, kind: service}]
    owner: "railiance-platform"
    rotation: {path: "Federated; the KeyCape client secret rotates in the keycape declaration", coupling: [keycape]}
    status: active
  - name: coding-agent
    principal_type: AGENT
    federated_role: true
    agent: {mode: unknown, presents_principal_type: service, max_token_ttl_seconds: 900, boundary_policy: agent-high-risk-boundary}
    purpose: "JWT role and AppRole for the coding agent; policies agent-high-risk-boundary and workload-kv-read-issue-core-runtime, fifteen minutes"
    grants: [{mode: OBSERVE, scope: "kv metadata, token self", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: boundary deny wins; no KV data read"}]
    interactive_login: false
    second_factor: not_applicable
    custody: [none]
    consumers: [{name: codex-railiance-platform, kind: service}]
    owner: "railiance-platform"
    rotation: {path: "Federated for the JWT role; AppRole secret rotation owned by railiance-platform", coupling: []}
    status: active
exceptions: []