schema_version: "0.1"
service: keycape
owner: "key-cape owners"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [tools/bootstrap-recovery/identity-backup-profile.json, sso-mfa/k8s/keycape/deployment.yaml, sso-mfa/k8s/keycape/bootstrap-config.json, docs/service-identity-inventory.md]
  owner_confirmed: false
complete: false
identities:
  - name: secrets-engine-openbao
    principal_type: SERVICE
    purpose: "Confidential OIDC client; obtains a login token whose only scope is openbao:login"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: USE, scope: openbao, activation: STANDING, environments: [PRODUCTION], note: "scope openbao:login only; openbao:admin denied"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: secrets-engine, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
    status: active
  - name: secrets-engine-approval
    principal_type: SERVICE
    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: USE, scope: "approval-engine: approval:read, approval:consume", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff service-clients.example.yaml L27-39, token.go:355-363"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: secrets-engine, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
    status: active
  - name: secrets-engine-requester
    principal_type: SERVICE
    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L106-119; subject lacks service: prefix"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: secrets-engine, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
    status: active
  - name: approval-engine-operator
    principal_type: SERVICE
    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: OPERATE, scope: "approval-engine: approval:create, read, approve, revoke, supersede, observe, emit", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L57-69; withdrawn 2026-09-09, still registered; SI-11 retirement candidate"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: approval-engine, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, approval-engine]}
    status: active
  - name: informed-decision-sitting-requester
    principal_type: SERVICE
    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135"}
      - {mode: USE, scope: "approval-engine: approval:read", activation: STANDING, environments: [PRODUCTION], note: "key-cape 82b471f; live 2026-11-01, hub decision 21a557a9"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: informed-decision-sitting, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, informed-decision-sitting]}
    status: active
  - name: rapp-qonto
    principal_type: SERVICE
    purpose: "Confidential OIDC client; its token scopes are not established in the repository"
    grants:
      - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
      - {mode: unknown, scope: "token scopes", note: "reference config: rapp-qonto-client, qonto:read; confirm live (KEY-WP-0045-T02)"}
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: rapp-qonto, kind: service}]
    owner: "key-cape owners and the consuming service owner"
    rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, rapp-qonto]}
    status: active