coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Refuse explicit policy authentication and binding denials before side effects
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 16:46:00 +02:00
parent 11e5e8be0f
commit 31d9b6671c
5 changed files with 151 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
wiki/PolicyGatedSigning.md
View file

@ -134,6 +134,11 @@ truth.
## Caller identity
An HTTP 401 or 403 from the policy service refuses the operation under every
outage profile. It is an explicit caller-authentication or system-binding refusal,
not evaluator unavailability. Resolve the admitted caller and resource contract;
do not retry with a different resource owner or disable caller enforcement.
The production flex-auth pin authenticates ops-warden with Kubernetes
TokenReview and binds `resource.system: ops-warden` to
`system:serviceaccount:ops-warden:ops-warden`. Supported token sources are: