From 0a6175e5e205b6f77d0b8f8217302c63ec94194a Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 24 Sep 2026 09:56:47 +0200 Subject: [PATCH] Name access-engine as the only authorization decision point. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f --- INTENT.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/INTENT.md b/INTENT.md index 46b3837..264d8c0 100644 --- a/INTENT.md +++ b/INTENT.md @@ -335,7 +335,7 @@ not need, some separate live registration API into ops-warden. | Need | Owner | ops-mason's relationship | |---|---|---| | Whether access *should* exist at all | Architecture docs / founder | ops-mason builds what's decided, does not decide policy from nothing | -| Runtime authorization ("may actor X do Y") | flex-auth | ops-mason provisions the policy; flex-auth evaluates it at runtime | +| Runtime authorization ("may actor X do Y") | access-engine (repository `flex-auth`) | ops-mason provisions the policy; access-engine evaluates it at runtime | | Identity, MFA, human auth | key-cape / Keycloak | Out of scope entirely | | Routing consumers to the right lane | ops-warden | ops-mason feeds ops-warden's catalog; does not replace `warden access`/`warden route` | | SSH certificate issuance | ops-warden | Untouched — ops-mason works in OpenBao AppRole/policy/KV space, not the SSH CA lane | @@ -390,7 +390,7 @@ ops-mason — builds the infrastructure that architecture calls fo ops-warden — routes consumers to what ops-mason built | v -OpenBao / flex-auth / key-cape — hold custody, evaluate policy, verify identity +OpenBao / access-engine (`flex-auth`) / key-cape — hold custody, evaluate policy, verify identity ``` NetKingdom defines what the security model should look like. ops-mason @@ -411,7 +411,7 @@ ops-warden itself exists to prevent. plan - Touching secret values at all, even transiently — structure only; values go in via ops-warden's `paste_once_provision` desk, not through ops-mason -- Owning OpenBao cluster lifecycle, flex-auth runtime, or key-cape identity +- Owning OpenBao cluster lifecycle, the access-engine runtime (repository `flex-auth`), or key-cape identity ---