tegwick
c9e5ead43b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
56 lines
1.8 KiB
Markdown
56 lines
1.8 KiB
Markdown
---
|
|
id: NK-WP-0042
|
|
type: workplan
|
|
title: "Let workloads require MFA for all or part of their features"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: proposed
|
|
flavor: planning
|
|
owner: claude-code
|
|
topic_slug: netkingdom
|
|
created: "2026-09-23"
|
|
updated: "2026-09-23"
|
|
related: [NK-ADR-0016, NK-WP-0037]
|
|
state_hub_workstream_id: "3f702215-704b-5788-8ca0-b8b9ba2dd3f8"
|
|
---
|
|
|
|
ADR-0016 makes MFA a user preference by default and lets a workload require
|
|
it for all or some of its features. This workplan defines how a workload
|
|
states that requirement and how the flow enforces it. It does not require MFA
|
|
anywhere; the enrollment and recovery usability gate in ADR-0016 still
|
|
applies first.
|
|
|
|
## Specify the workload-requested step-up contract
|
|
|
|
```task
|
|
id: NK-WP-0042-T01
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "d66a6347-b714-5cca-aeb5-7121328f4dec"
|
|
```
|
|
|
|
Define how a workload requests AAL2: per client registration for the whole
|
|
feature set, or per request as a step-up when a protected feature is used.
|
|
Specify:
|
|
|
|
- which OIDC parameter the request uses (`acr_values`, `max_age`, or both);
|
|
- what KeyCape must return when a user has no factor (a clean refusal and an
|
|
enrollment route, never silent AAL1);
|
|
- how the resulting `assurance.level` reaches flex-auth.
|
|
|
|
Record it as an IAM Profile amendment. key-cape owns the implementation.
|
|
|
|
## Agree the user-facing step-up and enrollment journey
|
|
|
|
```task
|
|
id: NK-WP-0042-T02
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf"
|
|
```
|
|
|
|
With user-engine (U06, factor recovery) and one pilot workload, agree what a
|
|
user sees when a feature needs MFA and they have none. That includes the
|
|
enrollment detour, the return to the feature, and recovery. It must be
|
|
accepted from a user's perspective before any workload turns the requirement
|
|
on.
|