tegwick
d96aab2321
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
146 lines
5.3 KiB
Markdown
146 lines
5.3 KiB
Markdown
---
|
|
id: capability.security.iam-tooling-suite
|
|
name: NetKingdom Security/IAM Tooling Suite
|
|
summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation,
|
|
and deterministic plan-only security scenario composition.
|
|
owner: net-kingdom
|
|
status: draft
|
|
domain: infotech
|
|
tags:
|
|
- security
|
|
- iam
|
|
- kubernetes
|
|
- conformance
|
|
maturity:
|
|
discovery:
|
|
current: D3
|
|
target: D5
|
|
confidence: medium
|
|
rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit
|
|
integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon,
|
|
and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition,
|
|
tenancy, zone, and boundary standards that provider repos implement against.
|
|
availability:
|
|
current: A2
|
|
target: A3
|
|
confidence: medium
|
|
rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable
|
|
conformance, posture, scenario-composition, and guarded bootstrap tools; local-identity is separately
|
|
packaged and tested.'
|
|
external_evidence:
|
|
completeness:
|
|
level: C1
|
|
confidence: low
|
|
basis: scope_vs_intent_and_consumer_expectations
|
|
satisfied_expectations:
|
|
- versioned canon standards already implemented by a sibling repo (key-cape)
|
|
- documented, runnable conformance, posture, composition, and bootstrap tools under tools/
|
|
broken_expectations: []
|
|
out_of_scope_expectations: []
|
|
reliability:
|
|
level: R1
|
|
confidence: low
|
|
basis: consumer_quality_signals
|
|
known_reliability_risks:
|
|
- no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install
|
|
path yet
|
|
discovery:
|
|
intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling
|
|
so provider implementations can integrate without inferred authority or hidden deployment coupling.
|
|
includes:
|
|
- canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards
|
|
- IAM profile conformance checker
|
|
- playbook capability contract validator
|
|
- deterministic plan-only security scenario composer
|
|
- tenancy posture schema and validator
|
|
- security bootstrap console (local, non-secret-collecting)
|
|
- packaged local bootstrap identity CLI
|
|
excludes:
|
|
- concrete IAM implementations themselves (see key-cape for lightweight mode)
|
|
- live secret value handling (bootstrap console explicitly refuses live OpenBao initialization)
|
|
assumptions: []
|
|
use_cases: []
|
|
research_memos: []
|
|
availability:
|
|
current_level: A2
|
|
target_level: A3
|
|
current_artifacts:
|
|
- tools/iam-profile-conformance
|
|
- tools/playbook-capability-contract
|
|
- tools/security-scenario-composer
|
|
- tools/tenancy-posture
|
|
- tools/security-bootstrap-console
|
|
- local-identity
|
|
target_artifacts: []
|
|
consumption_modes:
|
|
- cli
|
|
- local web ui
|
|
relations:
|
|
depends_on: []
|
|
supports: []
|
|
related_to: []
|
|
evidence:
|
|
documentation:
|
|
- README.md
|
|
- docs/secrets-engine-security-infrastructure-boundary.md
|
|
- tools/*/README.md
|
|
tests:
|
|
- tools/iam-profile-conformance (pytest fixtures)
|
|
consumer_feedback: []
|
|
bug_reports: []
|
|
incidents: []
|
|
consumer_guidance:
|
|
recommended_for:
|
|
- implementers needing to verify IAM/security conformance against Coulomb's canonical standards
|
|
not_recommended_for:
|
|
- needs for a packaged, single-install security suite (currently three separate tools)
|
|
known_limitations:
|
|
- no unified top-level packaging across the three tools
|
|
promotion_history: []
|
|
---
|
|
|
|
# NetKingdom Security/IAM Tooling Suite
|
|
|
|
## Overview
|
|
|
|
`net-kingdom` provides canonical IAM and security architecture, executable
|
|
conformance and posture checks, deterministic plan-only scenario composition,
|
|
a local bootstrap identity package, and a non-secret-collecting security
|
|
bootstrap console. Provider implementations remain in sibling repositories such
|
|
as `key-cape`; the self-optimizing platform remains an intent rather than a
|
|
current delivery claim.
|
|
|
|
## Assessment notes
|
|
|
|
### Discovery
|
|
|
|
SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an
|
|
explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden,
|
|
ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current
|
|
IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario
|
|
composition standards.
|
|
|
|
### Availability
|
|
|
|
No top-level package manifest exists. The independently runnable surfaces are
|
|
documented under `tools/`, and `local-identity` has its own package manifest and
|
|
test environment.
|
|
|
|
### Completeness
|
|
|
|
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
|
|
(reuse-surface). No external consumer feedback exists yet; levels reflect
|
|
scope-vs-intent documentation quality, not internal code quality.
|
|
|
|
### Reliability
|
|
|
|
No production consumer telemetry exists yet; reliability level is
|
|
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
|
|
|
|
## Promotion checklist
|
|
|
|
- [x] ID follows `capability.<domain>.<name>` pattern
|
|
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
|
|
- [x] `external_evidence` is populated separately from `maturity`
|
|
- [ ] Relations reference valid capability IDs (none yet)
|
|
- [x] Index entry added in `registry/indexes/capabilities.yaml`
|