tegwick 2387409d08 NK-WP-0056-T03 done: executor identity and authority ceiling, in source ... Executor credentials declared (planned) with executor_subject; service-identity gains convention executor (SI-15: approved-only grants, no person, not interactive) and --admissions, checking that an admission's ceiling lies inside the executor's declared grants (pilot covered). RBAC in sso-mfa/k8s/bounded-executor (not applied): ServiceAccount without automount, a Role limited to the authelia Deployment and ExternalSecret, no read of credential objects; tests tie Role, declaration and pilot ceiling. The pilot example's delivery check now reads the ExternalSecret status. railiance-apps and glas-harness answers recorded (T02). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87		2026-10-31 14:21:04 +01:00
..
bounded-execution-admission	NK-WP-0056-T03 done: executor identity and authority ceiling, in source	2026-10-31 14:21:04 +01:00
custody-record	Prepare empty custody baseline and record owner delivery handoff	2026-10-03 19:53:32 +02:00
playbook-capability-contract	Implement NK-WP-0013 playbook capability contract	2026-05-22 14:49:25 +02:00
posture-feedback	feat(posture): add deterministic feedback proposals	2026-08-23 13:16:34 +02:00
security-bootstrap	Add signed custody roster workflow	2026-06-02 01:11:42 +02:00
security-scenarios	feat(orchestration): compose KeyCape C1 and C2b	2026-08-23 13:24:55 +02:00