From 3dffe60a583dd54060dcc749bb335035f6aaed29 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Thu, 24 Sep 2026 09:56:51 +0200
Subject: [PATCH] Name access-engine as the only authorization decision point.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
---
 INTENT.md | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/INTENT.md b/INTENT.md
index 57e608c..401328d 100644
--- a/INTENT.md
+++ b/INTENT.md
@@ -130,14 +130,15 @@ owns one lane and points at the rest:
    (secrets-engine `exec`, railiance-platform `credential exec`) ops-warden routes to
    the owner's front door — it does not mint tokens or run the owner's tool itself.
    This is the assist layer, not a universal broker: custody stays in OpenBao /
-   secrets-engine / the platform broker; authorization in flex-auth.
+   secrets-engine / the platform broker; authorization in access-engine
+   (repository `flex-auth`).
 3. **Steward workload security posture conformance.** Author the ops-security slice
    for environment posture (`dev/test/prod`) and workload maturity (`M0-M3`), then
    ship descriptors and read-only checks that identify whether a secret-flow blocker
    is real, owner-routed, or removable with a contract double. Runtime enforcement
-   remains flex-auth; custody remains OpenBao.
+   remains access-engine; custody remains OpenBao.
 4. **Align** runbooks, wiki, inventory patterns, and scorecard checks with
-   NetKingdom canon as the platform evolves (OpenBao-first, flex-auth policy,
+   NetKingdom canon as the platform evolves (OpenBao-first, access-engine policy,
    key-cape IAM Profile, railiance deployment layers).
 5. **Issue** short-lived SSH certificates for `adm` / `agt` / `atm` actors when
    host or ops reachability requires the SSH lane — via `warden sign`,
@@ -219,7 +220,7 @@ Canonical references:
 | OIDC login, MFA, human identity claims | key-cape / Keycloak (NetKingdom IAM Profile) |
 | Security doctrine, invariants, authority model | gate-house |
 | Policy decision — may actor X access resource Y | access-engine (`flex-auth`) |
-| API keys, provider secrets, DB creds, object-storage STS | OpenBao (+ flex-auth policy where required) |
+| API keys, provider secrets, DB creds, object-storage STS | OpenBao (+ access-engine policy where required) |
 | Inter-Hub operator keys, LLM provider credentials | OpenBao or approved operator secret store |
 | Tunnel lifecycle, port forwarding | ops-bridge |
 | `/etc/ssh/auth_principals/`, host hardening | railiance-infra |
@@ -342,7 +343,7 @@ ops-warden (issue SSH; route / assist the rest)
         +-- Generic API / DB / provider secret? -> OpenBao path
         |       (warden access proxies as caller when exec_capable)
         |
-        +-- Authorization required? ------------> flex-auth decision
+        +-- Authorization required? ------------> access-engine decision
         |       (caller-side gate on sign + access when policy.enabled)
         |
         +-- Identity / MFA required? -------------> key-cape / Keycloak path
@@ -371,7 +372,7 @@ for one security lane plus operational guidance.
 
 ops-warden should appear in NetKingdom responsibility and pattern material as
 the **operational SSH credential authority**, not as a replacement for
-OpenBao or flex-auth.
+OpenBao or access-engine.
 
 ---
 
@@ -398,8 +399,8 @@ ops-warden is succeeding when:
 ## Non-goals
 
 - Universal credential broker for all secret types
-- Runtime enforcement of the workload secret-flow lattice (flex-auth owns that)
-- Replacing OpenBao, flex-auth, key-cape, or railiance deployment ownership
+- Runtime enforcement of the workload secret-flow lattice (access-engine owns that)
+- Replacing OpenBao, access-engine, key-cape, or railiance deployment ownership
 - Storing Inter-Hub, LLM provider, or other long-lived API keys
 - Host-side SSH configuration deployment
 - **Duplicating or restating another subsystem's procedure** — routing material
@@ -416,7 +417,7 @@ ops-warden is succeeding when:
 The repository shipped the SSH CA CLI first (WARDEN-WP-0001–0003). The
 stewardship and NetKingdom-alignment mission is the **next stratum** — docs,
 routing canon, inventory standards, production OpenBao SSH engine alignment,
-flex-auth integration design, and NetKingdom cross-links — without collapsing
+access-engine integration design, and NetKingdom cross-links — without collapsing
 platform boundaries.
 
 See `wiki/CredentialRouting.md` for worker-facing routing,