coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/workplans/NK-WP-0042-workload-mfa-step-up.md
tegwick ad4ec6e7a7
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Review: NK-WP-0040 ready, NK-WP-0042 backlog (operator decision) 
NK-WP-0042 waits until the voluntary MFA journeys are usable (ADR-0016).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
2026-09-24 01:23:00 +02:00

1.8 KiB
Raw Blame History

id type title domain repo status flavor owner topic_slug created updated related state_hub_workstream_id
NK-WP-0042 workplan Let workloads require MFA for all or part of their features infotech net-kingdom backlog planning claude-code netkingdom 2026-09-23 2026-09-24
NK-ADR-0016
NK-WP-0037
3f702215-704b-5788-8ca0-b8b9ba2dd3f8

ADR-0016 makes MFA a user preference by default and lets a workload require it for all or some of its features. This workplan defines how a workload states that requirement and how the flow enforces it. It does not require MFA anywhere; the enrollment and recovery usability gate in ADR-0016 still applies first.

Specify the workload-requested step-up contract

id: NK-WP-0042-T01
status: todo
priority: medium
state_hub_task_id: "d66a6347-b714-5cca-aeb5-7121328f4dec"

Define how a workload requests AAL2: per client registration for the whole feature set, or per request as a step-up when a protected feature is used. Specify:

  • which OIDC parameter the request uses (acr_values, max_age, or both);
  • what KeyCape must return when a user has no factor (a clean refusal and an enrollment route, never silent AAL1);
  • how the resulting assurance.level reaches flex-auth.

Record it as an IAM Profile amendment. key-cape owns the implementation.

Agree the user-facing step-up and enrollment journey

id: NK-WP-0042-T02
status: todo
priority: medium
state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf"

With user-engine (U06, factor recovery) and one pilot workload, agree what a user sees when a feature needs MFA and they have none. That includes the enrollment detour, the return to the feature, and recovery. It must be accepted from a user's perspective before any workload turns the requirement on.