schema_version: "0.1"
service: postgresql
owner: "railiance-platform (platform data services)"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [sso-mfa/k8s/postgresql/cluster.yaml]
  owner_confirmed: false
complete: false
identities:
  - name: privacyidea
    principal_type: SERVICE
    purpose: "Database role owning privacyidea_db in the net-kingdom-pg cluster"
    grants:
      - {mode: USE, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION]}
      - {mode: ADMINISTER, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION], note: "database owner"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: privacyidea, kind: service}]
    owner: "railiance-platform"
    rotation: {path: "PI_DB_PASSWORD: atomic update of database and pod (Credential Management section 6)", coupling: [privacyidea]}
    status: active