net-kingdom/docs/adr/ADR-0018-access-engine-core-as-production-pdp.md

id	type	title	status	owner	revision	decided	last_reviewed	review_interval	amends
NK-ADR-0018	architecture-decision-record	The access-engine Core Is the Production PDP; Topaz Is Deferred	accepted	net-kingdom	1	2026-10-27	2026-10-27	12m	NK-ADR-0006

ADR-0018 - access-engine Core as Production PDP

Status: Accepted by Bernd Worsch on 2026-10-27, as hub decision 37464824-a939-415f-8a7a-5f81cbf498c8 (NK-WP-0055-T10). Date: 2026-10-27 Decider: Bernd Worsch

Context

ADR-0006 and docs/platform-identity-security-architecture.md name Topaz as the first delegated policy decision point (PDP) behind flex-auth, now access-engine. In practice Topaz exists only as an adapter shape (FLEX-WP-0004), and nothing deploys it. Every live decision comes from the access-engine Go core.

The core already provides:

• tenant scope;
• relationship facts and inherited access;
• check, list-allowed and explain;
• caller authentication.

The core was shaped to Topaz's policy-plus-directory model from the start. The production readiness ledger (NK-WP-0055-T01) lists the Topaz runtime as an open area.

Decision

• The access-engine Go core is the production PDP. A delegated Topaz runtime is not required for production readiness, and that readiness area is an accepted exception.
• The PDP readiness checks still apply, but they are now run against the core:
  • health;
  • data freshness;
  • policy load status;
  • fail-closed behaviour, verified per consumer through each consumer's pep-stance.yaml.
• The policy import gap that Topaz bundles would have closed moves to NK-WP-0055-T14. Either policies load without an image rebuild, or rebuild-and-deploy is accepted as the import path.
• Topaz is no longer an expected audit source (NK-WP-0055-T11).
• Topaz is deferred, not rejected. ADR-0006's rule still holds for any future delegated PDP: it evaluates policy, and it never becomes the canonical policy model, the identity provider or the control plane.

Revisit when

• a tenant needs per-object sharing, or relationship data outgrows the core's relationship facts;
• the number of tenants or the depth of group nesting makes core evaluation a bottleneck;
• policy changes become too frequent for the T14 import path;
• the production declaration (NK-WP-0055-T09) reviews its accepted exceptions.

Consequences

• There is one less runtime to operate, back up, audit and drill.
• Authorization availability is coupled to access-engine. HA is out of scope by the same decision.
• Reversibility is high: adding Topaz later extends the system rather than rebuilding it.
• Where docs/platform-identity-security-architecture.md describes Topaz as the first delegated PDP, read it with this amendment.