schema_version: "0.1"
service: privacyidea
owner: "MFA and privacyIDEA owners (NetKingdom)"
declared_at: 2026-10-24
attestation:
  authored_by: claude-code
  basis: [sso-mfa/k8s/privacyidea/README.md, sso-mfa/k8s/privacyidea/bootstrap-admin.py, sso-mfa/k8s/keycape/deployment.yaml, docs/service-identity-inventory.md]
  owner_confirmed: false
complete: false
identities:
  - name: pi-admin
    principal_type: HUMAN
    conventions: [service-admin]
    purpose: "privacyIDEA's local administrator; policy pi-admin-all-rights restricted to adminuser=pi-admin"
    grants:
      - {mode: ADMINISTER, scope: privacyidea, activation: STANDING, environments: [PRODUCTION]}
      - {mode: GOVERN, scope: privacyidea, activation: STANDING, environments: [PRODUCTION], note: "pi-admin-all-rights can set the policies that bound other admins"}
    interactive_login: true
    second_factor: unknown
    custody: [personal-safe]
    consumers: [{name: founder, kind: person}]
    owner: "Founder and MFA owners"
    rotation: {path: "bootstrap-admin custody entry; password changes are a separate procedure", coupling: []}
    status: active
    recovery: {needed: true, works_with_sso_down: true, in_crisis_list: true}
  - name: trigger-admin
    principal_type: unknown
    conventions: [service-admin]
    purpose: "Legacy Keycloak-era administrator account, policy and Secret; who presents it is not established"
    grants: [{mode: ADMINISTER, scope: privacyidea, activation: STANDING, environments: [PRODUCTION]}]
    interactive_login: false
    second_factor: unknown
    custody: [delivered-secret]
    consumers: []
    owner: "MFA owners; revocation decided under NK-WP-0049-T22"
    rotation: {path: "None established; revocation needs a separate approval", coupling: []}
    status: legacy
    disposition: {action: defer, owner: "Founder", date: 2026-12-31}
  - name: keycape-factor-reader
    principal_type: SERVICE
    purpose: "KeyCape's access to read factor state; delivered by railiance-platform (RPF-WP-0040)"
    grants: [{mode: unknown, scope: privacyidea, note: "exact rights not established"}]
    interactive_login: false
    second_factor: not_applicable
    custody: [delivered-secret]
    consumers: [{name: keycape, kind: service}]
    owner: "railiance-platform and key-cape"
    rotation: {path: "Renewed by policy keycape-factor-renewer through ESO", coupling: [keycape]}
    status: active
exceptions:
  - id: SI-X3
    rules: [NAMING]
    identity: trigger-admin
    reason: "Legacy account whose name does not follow the admin naming form and whose consumers are uninventoried"
    owner: "Founder"
    expires: 2026-12-31
    compensating_control: "Not provisioned by the current bootstrap"
    elimination_path: "Revocation or acceptance under NK-WP-0049-T22"