tegwick
a3bab9210b
Founder clarifications: the SI-14 token ceiling is 60 minutes (3600 s); ld-admin is for LLDAP only and the name admin remains the human platform administrator's wherever it appears. The LLDAP rehearsal is now introducing ld-admin by configuration and demoting admin, not renaming. The validator rejects a service-admin named admin. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2.7 KiB
Service Identity Declaration Validator
NK-WP-0054-T03. Offline and read-only. Checks declarations against
canon/schemas/service-identity_v0.1.schema.json and evaluates the rules of the
proposed Service Identity and Privilege standard
that a declaration alone can decide. It was built against draft-1, before the founder's review,
so a rule change in the standard changes this tool. It now follows draft-2.
make service-identity-test # unit tests
make service-identity-check # evaluate the checked-in declarations
uv run tools/service-identity/validate.py tools/service-identity/declarations/*.yaml --as-of 2026-10-24
Options: --as-of YYYY-MM-DD (evaluation date, so a run is reproducible and exceptions expire on a
stated day), --json, --fail-on-findings (exit 2 when anything is non-conformant or unknown).
Exit 1 means invalid input.
Results
| Result | Meaning |
|---|---|
conformant |
Every checked rule holds on declared facts |
non-conformant |
At least one rule is broken and not covered by a live exception, or an exception has expired |
excepted |
Every broken rule has a live, time-boxed exception |
unknown |
A fact nobody has established (unknown in the declaration). A finding, not a pass |
planned |
A target identity that does not exist yet; never counted as conformant |
Alongside the results, advisories report declarations not asserted complete by their owner, declarations not confirmed by the owning service, stale exceptions, more than one service-admin and more than one break-glass identity.
Rules decided here
SI-1, SI-2, SI-3 (including a credential shared by more than one service), SI-6, SI-8 (including an
admin policy without a bound assurance claim), SI-9, SI-11 (overdue legacy disposition), SI-12, SI-14
(an agent must present as an agent, with a token lifetime at or below the 3600-second, 60-minute ceiling) and
the naming rules (NAMING). SI-4 (one admin per service) is an advisory. SI-5, SI-7, SI-10 and SI-13 are
not decidable from a declaration. Observed state (what is really configured) is the health check,
NK-WP-0054-T04.
Declarations
declarations/ holds the first set, authored from docs/service-identity-inventory.md. Decided 2026-10-24:
declarations start here and move to each service's repository as its owner confirms them. Every one says owner_confirmed: false: they describe what
the repository establishes, not what the owning service has attested. Facts the repository cannot
establish are unknown, never guessed.
Safety
A declaration holds no credential. Secret-shaped values are rejected, and schema messages are never printed because they can echo the rejected value; invalid input reports only a count.