# Directory group binding for a construction plan

A construction plan that needs an LLDAP group does not create it in ops-mason,
and user-engine does not create it either. user-engine owns account journeys
and factor enrollment. The group writer is net-kingdom's identity-provisioner.

## The automatic path

`POST /v1/groups/ensure` on identity-provisioner
(`net-kingdom/identity-provisioner/provisioner.py`, `ensure_service_groups`).
The matching rollback is `POST /v1/groups/revoke`. Both require the
provisioner's own bearer token and are reached inside the provisioner pod.
ops-warden does not publish a caller route for this: `identity-provisioner-groups`
was dropped (WARDEN-WP-0044, R8) because that token is user-engine's runtime
token and the pod network only admits user-engine.

The request names `groups`, `members`, `idempotency_key` and `correlation_id`.
The call creates a missing service-access group and adds the listed users. It
does not remove other members, and it does not create users. A group name
matches `[a-z][a-z0-9-]{1,62}` and must not start with `tenant`,
`netkingdom-`, `net-kingdom-` or `lldap_`. A username must already exist and
match `[a-z][a-z0-9._-]{0,31}`. `reuse-surface-hub-writers` and
`bernd.worsch-3` fit those shapes.

The SecurityCaseType `oidc-browser-relying-party` calls this `ensure-groups`,
attended, in the register-client session. There is no `identity-provisioner
groups ensure` command in the provisioner tree; the workplan text names that
shape, and the code is the HTTP path above.

## What this path does not do

- It does not enroll a second factor. `aal2` is a KeyCape claim on one login
  (`/assurance/level`), set only when that login verified MFA. Enrollment is
  privacyIDEA self-service at `https://pink-account.coulomb.social/`, realm
  `coulomb` (user-engine `docs/mfa-attended-run.md`).
- It does not choose the OpenBao entity. Entity policies such as
  `platform-admin` still have to be checked on the login token.
- `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` is the narrower
  bootstrap helper. It creates only `net-kingdom-users`, `net-kingdom-admins`
  and `activity-core-operators`, and its membership command requires the group
  to exist already.

## Reuse-surface

ops-mason records the pointer on `capability.security.structure-construction`.
The implementation owner is net-kingdom. A later owner entry can name
`POST /v1/groups/ensure` directly; until then this page is the consumer route.