Status
Accepted 2026-08-28, answering intake WARDEN-IN-0001 from gate-house, which carries decision GH-DEC-2026-001. The standard being adopted — net-kingdom/canon/standards/security-layer-model_v0.1.md — is proposed, and was proposed pending assent from flex-auth, kings-guard, and ops-warden. This ADR is ops-warden's half of that assent.
Context
The estate acquired overlapping claims to the same responsibility, most visibly two repositories describing themselves as the authorization control plane. The layer model resolves the overlap by layering repositories on determinism — Taxonomy, Tooling, Engines, Staff — and by two rules: Staff never touches Tooling directly (§5), and access-engine is the only policy decision point (§6).
ops-warden is assigned Staff. Two demarcations follow that touch this repository: the security curriculum it had been carrying belongs to gate-house, and the words access lane and access rule are bound to different owners.
Full reasoning: history/2026-08-28-security-layer-model-assent.md.
Decision
1. ops-warden is Staff and declares it. INTENT.md carries the layer label and the §5 invariant. ops-warden holds no state another layer depends on at runtime and renders no authorization decision — it consumes them.
2. Lanes, not rules. ops-warden owns how a worker reaches a host: SSH certificate issuance, the routing catalog, warden access, warden plan, cert_command. It never owns whether a worker may — that is access-engine (today flex-auth), and ops-warden neither renders nor caches that decision. This restates what ADR-0002 and ADR-0005 already bind; it is recorded here because the demarcation is now normative estate-wide and other repositories rely on ops-warden holding to it. The ruled rename flex-auth → access-engine is assented to; ops-warden asks only for a window in which both names resolve.
3. Doctrine goes to gate-house; runbooks stay here. ops-warden does not restate security doctrine, the authority model, or the curriculum. It references gate-house's. It keeps everything operational about the lanes it stewards: which subsystem owns which need, how to obtain a credential lane by lane, and conformance evidence for its own lanes. .claude/rules/credential-routing.md is runbook, not curriculum, and stays inlined in this and every other repository.
4. One declared engine gap, not an exemption. src/warden/vault.py (VaultCA) is a direct OpenBao client performing a write from a Staff repository. It is a §5 non-conformance. ops-warden declares it rather than arguing it away:
- intended owner:
secrets-engine(credential abstraction, custody, lifecycle) - blocked on: no engine exposes an SSH certificate signing surface
- review: with this ADR, every 3 months
Until that surface exists, ops-warden continues to sign — refusing to would remove production host access to close a documentation gap — and reports the position as open. warden desk's bao kv put is declared on the same terms. taint.py is metadata-only observation, declared under §5's read-only allowance. proxy.py supplies no authority of its own: it runs the owner's tool under the caller's identity and is governed by ADR-0002.
This is ADR-0003 turned inward. ops-warden has required an intended owner and a blocker on 27 catalog lanes it holds for other repositories; it holds itself to the same record.
Consequences
ops-warden's conformance under §10 is declared non-conformant with a tracked closure path, not clean. That is the accurate state and it is the state that gets fixed, because it names an owner who can fix it.
An amendment to §5 has been offered to gate-house — a second sanctioned shape alongside read-only diagnostics: a declared engine gap carrying intended owner, blocker, and review date, machine-readable so §10 can tell a tracked gap from an undeclared violation. It is offered, not assumed; §5 stays gate-house's to write. If gate-house declines it, ops-warden's position is a plain non-conformance and is reported as one.
The NetKingdom Security Literacy section stops being a prose second source for registry/routing/catalog.yaml, which ADR-0001 had already ruled against for catalog procedure.