tegwick
074b3a047b
Derive custody at platform/workloads/keycape/{client_id} (secret_ref is no
longer case-settable), reuse the workload-kv-read-keycape-* policy family with
templated bodies, add the external-secrets-keycape-{client_id} ESO role, name
the catalog entry {consuming_service}-keycape-client and collapse the duplicate
KV-path rollback. Schema and validator require a body on policy/role items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 330051@bnt-lap001
Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b
|
||
|---|---|---|
| .. | ||
| examples | ||
| tests | ||
| README.md | ||
| type.yaml | ||
SecurityCaseType template
Copy _template/ to security-case-types/<type-id>/ and rewrite every
section. Canon: canon/standards/security-case-types_v0.1.md. A type is
acknowledged through informed-decision only when this README, type.yaml, the
example cases and the tests are complete and green.
Purpose
Which recurring use case the type serves, and the hand-built instances it
replaces or adopts (reference instances). For the template: a loopback bootstrap
identity for one operator, composed from net-kingdom.local-identity.
Threat model
What the type protects, from whom, and how. Name the assets (credentials, sessions, signing keys), the actors (anonymous, low-assurance operator, tenant, compromised workload) and what each step does to prevent misuse. For the template: the store is loopback-only and private to its owner; the signing key is referenced from custody, never written into a case.
Alternatives considered
The other shapes this pattern could have taken and why they were not chosen. This is the part an informed-decision is mostly about.
Attended steps
Every step marked attended: true, why it cannot run unattended, and how
ops-warden groups such steps into as few attended sessions as possible.
Known limits
What the type does not cover, and when a request should become a new type or a new major version instead of a case.
Verification and rollback
How the checks in type.yaml prove a case is live without reading any value,
and how rollback restores the state from before the case.