tegwick
48385816fd
Schema, validator (30 tests), make targets and eight declarations authored from the inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown, 2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the founder's review. Building it changed the draft: custody is a list, SI-X1 now covers SI-9 and NAMING, and the reserved-name rule applies only to credential-holding identities (open question 7). Unknown is a finding for every class. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
21 lines
871 B
YAML
21 lines
871 B
YAML
schema_version: "0.1"
|
|
service: identity-provisioner
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [sso-mfa/k8s/identity-provisioner/deployment.yaml, docs/service-identity-inventory.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: identity-provisioner-token
|
|
classes: [workload]
|
|
purpose: "Service token that user-engine presents; the NetworkPolicy admits only user-engine pods"
|
|
privilege_level: write_scoped
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: user-engine, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Kubernetes Secret identity-provisioner-token; owner rotation", coupling: [user-engine, identity-provisioner]}
|
|
status: active
|