tegwick
635029b117
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
76 lines
4 KiB
YAML
76 lines
4 KiB
YAML
schema_version: "0.1"
|
|
service: openbao
|
|
owner: "railiance-platform"
|
|
declared_at: 2026-10-24
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [railiance-platform openbao/auth/netkingdom-platform-admin-role.json, railiance-platform openbao/auth/credential-broker-keycape-client-secret-generate-oidc-role.json, railiance-platform openbao/auth/secrets-engine-jwt-role.json, railiance-platform openbao/auth/coding-agent-jwt-role.json, railiance-platform openbao/auth/fluid-telegram-hall-of-helix-oidc-role.json]
|
|
owner_confirmed: false
|
|
complete: false
|
|
identities:
|
|
- name: netkingdom-platform-admin
|
|
principal_type: HUMAN
|
|
federated_role: true
|
|
purpose: "OIDC role: group net-kingdom-admins receives policies platform-admin and operator-custody, one-hour token"
|
|
grants: [{mode: ADMINISTER, scope: openbao, activation: STANDING, environments: [PRODUCTION]}]
|
|
assurance_claim_bound: true
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [none]
|
|
consumers: [{name: members of net-kingdom-admins, kind: person}]
|
|
owner: "railiance-platform"
|
|
rotation: {path: "Federated; membership and policy change by reviewed change", coupling: []}
|
|
status: active
|
|
recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
|
|
- name: credential-broker-keycape-client-secret-generate
|
|
principal_type: HUMAN
|
|
federated_role: true
|
|
purpose: "OIDC role: net-kingdom-admins with aal2 may generate a KeyCape client secret in custody"
|
|
grants: [{mode: ADMINISTER, scope: "openbao/platform/workloads/keycape", activation: STANDING, environments: [PRODUCTION]}]
|
|
assurance_claim_bound: true
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [none]
|
|
consumers: [{name: members of net-kingdom-admins, kind: person}]
|
|
owner: "railiance-platform"
|
|
rotation: {path: "Federated; policy change by reviewed change", coupling: []}
|
|
status: active
|
|
- name: fluid-telegram-operators
|
|
principal_type: HUMAN
|
|
federated_role: true
|
|
purpose: "OIDC role: fluid-telegram operators with aal2"
|
|
grants: [{mode: OPERATE, scope: "kv: fluid-telegram/hall-of-helix, 4 exact entries", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: create/read/update, no list/delete; TTL 15m, max 30m"}]
|
|
assurance_claim_bound: true
|
|
interactive_login: true
|
|
second_factor: required
|
|
custody: [none]
|
|
consumers: [{name: members of fluid-telegram-operators, kind: person}]
|
|
owner: "railiance-platform"
|
|
rotation: {path: "Federated; policy change by reviewed change", coupling: []}
|
|
status: active
|
|
- name: secrets-engine-openbao
|
|
principal_type: SERVICE
|
|
federated_role: true
|
|
purpose: "JWT role: subject service:secrets-engine, scope openbao:login, policy secrets-engine-login-self, five-minute token"
|
|
grants: [{mode: USE, scope: openbao, activation: STANDING, environments: [PRODUCTION], note: "login-self only"}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [none]
|
|
consumers: [{name: secrets-engine, kind: service}]
|
|
owner: "railiance-platform"
|
|
rotation: {path: "Federated; the KeyCape client secret rotates in the keycape declaration", coupling: [keycape]}
|
|
status: active
|
|
- name: coding-agent
|
|
principal_type: AGENT
|
|
federated_role: true
|
|
agent: {mode: unknown, presents_principal_type: service, max_token_ttl_seconds: 900, boundary_policy: agent-high-risk-boundary}
|
|
purpose: "JWT role and AppRole for the coding agent; policies agent-high-risk-boundary and workload-kv-read-issue-core-runtime, fifteen minutes"
|
|
grants: [{mode: OBSERVE, scope: "kv metadata, token self", activation: STANDING, environments: [PRODUCTION], note: "rpf bd8ca57: boundary deny wins; no KV data read"}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [none]
|
|
consumers: [{name: codex-railiance-platform, kind: service}]
|
|
owner: "railiance-platform"
|
|
rotation: {path: "Federated for the JWT role; AppRole secret rotation owned by railiance-platform", coupling: []}
|
|
status: active
|
|
exceptions: []
|