coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name access-engine as the only authorization decision point.

Browse source 
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
This commit is contained in:
tegwick 2026-09-24 09:56:47 +02:00
parent 3b8f248a8f
commit 0a6175e5e2
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
INTENT.md
View file

@ -335,7 +335,7 @@ not need, some separate live registration API into ops-warden.
| Need | Owner | ops-mason's relationship | | Need | Owner | ops-mason's relationship |
|---|---|---| |---|---|---|
| Whether access *should* exist at all | Architecture docs / founder | ops-mason builds what's decided, does not decide policy from nothing | | Whether access *should* exist at all | Architecture docs / founder | ops-mason builds what's decided, does not decide policy from nothing |
| Runtime authorization ("may actor X do Y") | flex-auth | ops-mason provisions the policy; flex-auth evaluates it at runtime | | Runtime authorization ("may actor X do Y") | access-engine (repository `flex-auth`) | ops-mason provisions the policy; access-engine evaluates it at runtime |
| Identity, MFA, human auth | key-cape / Keycloak | Out of scope entirely | | Identity, MFA, human auth | key-cape / Keycloak | Out of scope entirely |
| Routing consumers to the right lane | ops-warden | ops-mason feeds ops-warden's catalog; does not replace `warden access`/`warden route` | | Routing consumers to the right lane | ops-warden | ops-mason feeds ops-warden's catalog; does not replace `warden access`/`warden route` |
| SSH certificate issuance | ops-warden | Untouched — ops-mason works in OpenBao AppRole/policy/KV space, not the SSH CA lane | | SSH certificate issuance | ops-warden | Untouched — ops-mason works in OpenBao AppRole/policy/KV space, not the SSH CA lane |
@ -390,7 +390,7 @@ ops-mason — builds the infrastructure that architecture calls fo
ops-warden — routes consumers to what ops-mason built ops-warden — routes consumers to what ops-mason built
| |
v v
OpenBao / flex-auth / key-cape — hold custody, evaluate policy, verify identity OpenBao / access-engine (`flex-auth`) / key-cape — hold custody, evaluate policy, verify identity
``` ```
NetKingdom defines what the security model should look like. ops-mason NetKingdom defines what the security model should look like. ops-mason
@ -411,7 +411,7 @@ ops-warden itself exists to prevent.
plan plan
- Touching secret values at all, even transiently — structure only; values - Touching secret values at all, even transiently — structure only; values
go in via ops-warden's `paste_once_provision` desk, not through ops-mason go in via ops-warden's `paste_once_provision` desk, not through ops-mason
- Owning OpenBao cluster lifecycle, flex-auth runtime, or key-cape identity - Owning OpenBao cluster lifecycle, the access-engine runtime (repository `flex-auth`), or key-cape identity
--- ---