tegwick
c1b60f322e
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 1m10s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
319 lines
41 KiB
HTML
319 lines
41 KiB
HTML
<!doctype html>
|
|
<html lang="en"><meta charset="utf-8">
|
|
<meta name="policy-source-revision" content="9781102e2971d762ae42fdd5085a6647afd1cd66">
|
|
<meta name="policy-source-digest" content="6c47b596ea145fa197c9665081c84902482d90f5bb94d185c1223af65279be1d">
|
|
<title>NetKingdom IAM Profile v0.3</title>
|
|
<style>
|
|
:root{
|
|
--paper:#EDEEF0; --surface:#F6F7F8; --surface-2:#E4E6E9;
|
|
--ink:#171D24; --ink-2:#4A5561; --ink-3:#737E8A;
|
|
--rule:#D3D7DC; --rule-strong:#B6BCC3;
|
|
--brass:#8A6A2E; --brass-soft:#EFE5CD; --brass-line:#C9AE74;
|
|
--clay:#8A3A2C; --clay-soft:#F2DFDA;
|
|
--l0:#DCE0E2; --l1:#B9C4C7; --l2:#8CA1A6; --l3:#567D84; --l4:#23555E;
|
|
--chip-fg:#F6F7F8;
|
|
--font-display:ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",sans-serif;
|
|
--font-body:"Iowan Old Style","Palatino Linotype",Palatino,Georgia,serif;
|
|
--font-mono:ui-monospace,"SF Mono","Cascadia Code",Menlo,Consolas,monospace;
|
|
--measure:66ch;
|
|
}
|
|
@media (prefers-color-scheme:dark){
|
|
:root:not([data-theme="light"]){
|
|
--paper:#12161A; --surface:#191E24; --surface-2:#222831;
|
|
--ink:#E6E9EC; --ink-2:#A3ADB7; --ink-3:#78838E;
|
|
--rule:#2A3138; --rule-strong:#3B444D;
|
|
--brass:#C9A45C; --brass-soft:#33290F; --brass-line:#6B5426;
|
|
--clay:#D08A76; --clay-soft:#3A211B;
|
|
--l0:#262C32; --l1:#35424A; --l2:#4A626B; --l3:#6A939D; --l4:#97C4CD;
|
|
--chip-fg:#12161A;
|
|
}
|
|
}
|
|
:root[data-theme="dark"]{
|
|
--paper:#12161A; --surface:#191E24; --surface-2:#222831;
|
|
--ink:#E6E9EC; --ink-2:#A3ADB7; --ink-3:#78838E;
|
|
--rule:#2A3138; --rule-strong:#3B444D;
|
|
--brass:#C9A45C; --brass-soft:#33290F; --brass-line:#6B5426;
|
|
--clay:#D08A76; --clay-soft:#3A211B;
|
|
--l0:#262C32; --l1:#35424A; --l2:#4A626B; --l3:#6A939D; --l4:#97C4CD;
|
|
--chip-fg:#12161A;
|
|
}
|
|
|
|
*{box-sizing:border-box}
|
|
body{
|
|
margin:0; background:var(--paper); color:var(--ink);
|
|
font-family:var(--font-body); font-size:17px; line-height:1.62;
|
|
-webkit-font-smoothing:antialiased;
|
|
}
|
|
.wrap{max-width:1180px;margin:0 auto;padding:0 24px 96px}
|
|
.layout{display:grid;grid-template-columns:180px minmax(0,1fr);gap:56px;align-items:start}
|
|
@media (max-width:960px){.layout{grid-template-columns:1fr;gap:0}.rail{display:none}}
|
|
|
|
/* ---------- rail ---------- */
|
|
.rail{position:sticky;top:28px;padding-top:8px;font-family:var(--font-display);font-size:12px;line-height:1.5}
|
|
.rail ol{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:7px}
|
|
.rail a{color:var(--ink-3);text-decoration:none;display:flex;gap:9px}
|
|
.rail a:hover,.rail a:focus-visible{color:var(--brass)}
|
|
.rail .n{font-family:var(--font-mono);font-size:10px;color:var(--rule-strong);min-width:16px;padding-top:1px}
|
|
.rail .grp{margin-top:14px;font-size:9.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--rule-strong)}
|
|
|
|
/* ---------- header ---------- */
|
|
header{padding:64px 0 40px;border-bottom:2px solid var(--ink);margin-bottom:44px}
|
|
.eyebrow{font-family:var(--font-mono);font-size:11.5px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);display:flex;flex-wrap:wrap;gap:14px;margin-bottom:22px}
|
|
.eyebrow .stat{color:var(--clay)}
|
|
h1{font-family:var(--font-display);font-weight:800;letter-spacing:-.035em;line-height:.94;font-size:clamp(46px,9vw,92px);margin:0 0 6px;text-wrap:balance}
|
|
.sub{font-family:var(--font-display);font-weight:500;font-size:clamp(16px,2.4vw,21px);letter-spacing:-.01em;color:var(--ink-2);margin:0 0 30px;max-width:34ch;line-height:1.3}
|
|
.metagrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:20px 28px;border-top:1px solid var(--rule);padding-top:20px}
|
|
.metagrid dt{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);margin-bottom:5px}
|
|
.metagrid dd{margin:0;font-family:var(--font-display);font-size:13.5px;line-height:1.45;color:var(--ink)}
|
|
|
|
/* ---------- typography ---------- */
|
|
section{margin-bottom:60px;scroll-margin-top:24px}
|
|
h2{font-family:var(--font-display);font-weight:750;letter-spacing:-.022em;font-size:clamp(24px,3.4vw,31px);line-height:1.12;margin:0 0 18px;text-wrap:balance;display:flex;gap:14px;align-items:baseline}
|
|
h2 .sn{font-family:var(--font-mono);font-size:12px;font-weight:400;color:var(--brass);letter-spacing:.06em;flex:none;padding-top:2px}
|
|
h3{font-family:var(--font-display);font-weight:700;font-size:16px;letter-spacing:-.008em;margin:34px 0 10px;color:var(--ink)}
|
|
p{margin:0 0 15px;max-width:var(--measure)}
|
|
ul,ol{max-width:var(--measure);margin:0 0 15px;padding-left:20px}
|
|
li{margin-bottom:7px}
|
|
strong{font-weight:600}
|
|
em{font-style:italic}
|
|
code{font-family:var(--font-mono);font-size:.855em;background:var(--surface-2);padding:1px 5px;border-radius:2px}
|
|
a{color:var(--brass)}
|
|
.lede{font-size:19px;line-height:1.55;color:var(--ink-2);max-width:60ch}
|
|
|
|
/* ---------- devices ---------- */
|
|
.callout{border-left:3px solid var(--brass);background:var(--brass-soft);padding:18px 22px;margin:0 0 24px;max-width:var(--measure)}
|
|
.callout p:last-child{margin-bottom:0}
|
|
.callout .lbl{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--brass);display:block;margin-bottom:8px}
|
|
.rule-quote{border-top:2px solid var(--ink);border-bottom:2px solid var(--ink);padding:26px 0;margin:28px 0;max-width:var(--measure)}
|
|
.rule-quote p{font-family:var(--font-display);font-weight:600;font-size:19px;line-height:1.38;letter-spacing:-.014em;margin:0;text-wrap:balance}
|
|
.hard{border-left:3px solid var(--clay);background:var(--clay-soft);padding:18px 22px;margin:0 0 24px;max-width:var(--measure)}
|
|
.hard .lbl{font-family:var(--font-mono);font-size:10px;letter-spacing:.13em;text-transform:uppercase;color:var(--clay);display:block;margin-bottom:8px}
|
|
.hard p:last-child{margin-bottom:0}
|
|
.dec{font-family:var(--font-mono);font-size:10.5px;letter-spacing:.08em;color:var(--brass);text-transform:uppercase}
|
|
.vec{font-family:var(--font-mono);font-size:.9em;font-weight:600;background:var(--surface-2);padding:2px 7px;border-radius:2px;white-space:nowrap;letter-spacing:.04em}
|
|
|
|
/* ---------- tables ---------- */
|
|
.scroll{overflow-x:auto;margin:0 0 24px;-webkit-overflow-scrolling:touch}
|
|
table{border-collapse:collapse;width:100%;min-width:520px;font-family:var(--font-display);font-size:13.5px;line-height:1.45}
|
|
th{text-align:left;font-family:var(--font-mono);font-size:9.5px;letter-spacing:.13em;text-transform:uppercase;color:var(--ink-3);font-weight:400;padding:0 16px 8px 0;border-bottom:1px solid var(--rule-strong);vertical-align:bottom}
|
|
td{padding:11px 16px 11px 0;border-bottom:1px solid var(--rule);vertical-align:top;color:var(--ink-2)}
|
|
td:first-child{color:var(--ink);font-weight:600}
|
|
tbody tr:last-child td{border-bottom:none}
|
|
.lvl{font-family:var(--font-mono);font-weight:600;font-size:12px;letter-spacing:.04em;color:var(--ink)}
|
|
|
|
/* ---------- ladders ---------- */
|
|
.breakout{margin:34px 0 40px}
|
|
.bhead{display:flex;justify-content:space-between;align-items:baseline;gap:20px;border-bottom:1px solid var(--rule-strong);padding-bottom:9px;margin-bottom:22px;flex-wrap:wrap}
|
|
.bhead h3{margin:0;font-size:13px;letter-spacing:.1em;text-transform:uppercase;font-family:var(--font-mono);font-weight:400;color:var(--ink-3)}
|
|
.bhead .note{font-family:var(--font-display);font-size:12.5px;color:var(--ink-3)}
|
|
.ladders{display:grid;gap:26px}
|
|
.ladder{display:grid;grid-template-columns:126px minmax(0,1fr);gap:18px;align-items:start}
|
|
@media (max-width:700px){.ladder{grid-template-columns:1fr;gap:10px}}
|
|
.ladder .pname{font-family:var(--font-display);font-weight:700;font-size:14px;letter-spacing:-.01em;padding-top:2px}
|
|
.ladder .pname span{display:block;font-family:var(--font-mono);font-size:10px;font-weight:400;letter-spacing:.1em;text-transform:uppercase;color:var(--ink-3);margin-top:3px}
|
|
.rungs{display:grid;gap:3px;grid-template-columns:repeat(5,minmax(0,1fr))}
|
|
@media (max-width:700px){.rungs{grid-template-columns:repeat(2,minmax(0,1fr))}}
|
|
.rung{padding:9px 10px 11px;background:var(--surface);border-top:4px solid var(--l0);min-width:0}
|
|
.rung.r1{border-top-color:var(--l1)} .rung.r2{border-top-color:var(--l2)}
|
|
.rung.r3{border-top-color:var(--l3)} .rung.r4{border-top-color:var(--l4)}
|
|
.rung .code{font-family:var(--font-mono);font-size:11px;font-weight:600;letter-spacing:.06em;color:var(--ink);display:block;margin-bottom:4px}
|
|
.rung .txt{font-family:var(--font-display);font-size:11.5px;line-height:1.34;color:var(--ink-2);display:block}
|
|
.rung.na{opacity:.42}
|
|
|
|
/* ---------- matrix ---------- */
|
|
.matrix-shell{display:grid;grid-template-columns:auto minmax(0,1fr);gap:12px;align-items:stretch;margin-bottom:14px}
|
|
.ylab{writing-mode:vertical-rl;transform:rotate(180deg);font-family:var(--font-mono);font-size:9.5px;letter-spacing:.14em;text-transform:uppercase;color:var(--ink-3);text-align:center;padding-bottom:22px}
|
|
.mgrid{display:grid;grid-template-columns:34px repeat(5,minmax(0,1fr));gap:3px}
|
|
.mcell{background:var(--surface);min-height:60px;padding:6px;display:flex;flex-direction:column;justify-content:flex-end;gap:4px;min-width:0}
|
|
.mcell.tint1{background:color-mix(in srgb,var(--l1) 26%,var(--surface))}
|
|
.mcell.tint2{background:color-mix(in srgb,var(--l2) 26%,var(--surface))}
|
|
.mcell.tint3{background:color-mix(in srgb,var(--l3) 24%,var(--surface))}
|
|
.mcell.tint4{background:color-mix(in srgb,var(--l4) 22%,var(--surface))}
|
|
.mcell.void{background:repeating-linear-gradient(135deg,transparent,transparent 5px,var(--rule) 5px,var(--rule) 6px);opacity:.55}
|
|
.rlab,.clab{font-family:var(--font-mono);font-size:10px;font-weight:600;letter-spacing:.05em;color:var(--ink-3);display:flex;align-items:center;justify-content:center}
|
|
.rlab{min-height:60px}
|
|
.clab{padding-top:7px;min-height:22px}
|
|
.pin{font-family:var(--font-mono);font-size:9.5px;font-weight:600;letter-spacing:.02em;background:var(--ink);color:var(--paper);padding:2px 5px;border-radius:2px;line-height:1.3;display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
|
|
.pin.ghost{background:transparent;color:var(--ink-2);border:1px dashed var(--rule-strong)}
|
|
.mnote{display:flex;gap:22px;flex-wrap:wrap;font-family:var(--font-display);font-size:12px;color:var(--ink-3);padding-top:6px}
|
|
.mnote .k{display:flex;align-items:center;gap:7px}
|
|
.sw{width:13px;height:13px;flex:none;background:var(--ink)}
|
|
.sw.g{background:transparent;border:1px dashed var(--rule-strong)}
|
|
.sw.v{background:repeating-linear-gradient(135deg,transparent,transparent 4px,var(--rule) 4px,var(--rule) 5px);border:1px solid var(--rule)}
|
|
@media (max-width:640px){
|
|
.mgrid{grid-template-columns:28px repeat(5,minmax(0,1fr))}
|
|
.mcell{min-height:52px;padding:4px}
|
|
.pin{font-size:8px;padding:1px 3px}
|
|
.rlab{min-height:52px}
|
|
}
|
|
|
|
/* ---------- methodology ---------- */
|
|
.verbs{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:2px;background:var(--rule);border:1px solid var(--rule)}
|
|
.verb{background:var(--surface);padding:18px 18px 20px}
|
|
.verb h4{font-family:var(--font-display);font-weight:750;font-size:15px;margin:0 0 7px;letter-spacing:-.01em}
|
|
.verb p{font-family:var(--font-display);font-size:12.5px;line-height:1.46;color:var(--ink-2);margin:0;max-width:none}
|
|
.verb .step{font-family:var(--font-mono);font-size:9.5px;letter-spacing:.13em;color:var(--brass);display:block;margin-bottom:9px}
|
|
|
|
/* ---------- questions ---------- */
|
|
.qs{display:flex;flex-direction:column;gap:0;border-top:1px solid var(--rule-strong)}
|
|
.q{display:grid;grid-template-columns:34px minmax(0,1fr) 170px;gap:18px;padding:16px 0;border-bottom:1px solid var(--rule);align-items:start}
|
|
@media (max-width:760px){.q{grid-template-columns:28px minmax(0,1fr);gap:12px}.q .owner{grid-column:2}}
|
|
.q .qn{font-family:var(--font-mono);font-size:11px;color:var(--brass);padding-top:3px}
|
|
.q .qt{font-family:var(--font-display);font-size:14px;line-height:1.48;color:var(--ink-2)}
|
|
.q .qt b{color:var(--ink);font-weight:700;display:block;margin-bottom:2px;font-size:14.5px}
|
|
.owner{font-family:var(--font-mono);font-size:10px;letter-spacing:.05em;color:var(--ink-3);padding-top:4px}
|
|
.owner .tag{display:inline-block;border:1px solid var(--rule-strong);padding:2px 7px;border-radius:2px}
|
|
.owner .tag.need{border-color:var(--clay);color:var(--clay)}
|
|
|
|
/* ---------- misc ---------- */
|
|
.numbers{font-family:var(--font-mono);font-size:12.5px;line-height:1.85;background:var(--surface);border-left:3px solid var(--l3);padding:16px 20px;margin:0 0 22px;overflow-x:auto;max-width:var(--measure)}
|
|
.numbers .v{color:var(--ink);font-weight:600}
|
|
.numbers .k{color:var(--ink-3)}
|
|
pre{font-family:var(--font-mono);font-size:12.5px;line-height:1.68;background:var(--surface);border-left:3px solid var(--rule-strong);padding:16px 20px;overflow-x:auto;margin:0 0 22px;max-width:var(--measure);color:var(--ink-2)}
|
|
.alt{border-bottom:1px solid var(--rule);padding:14px 0;max-width:var(--measure)}
|
|
.alt:last-of-type{border-bottom:none}
|
|
.alt b{font-family:var(--font-display);font-size:14px;display:block;margin-bottom:3px}
|
|
.alt p{font-size:14.5px;margin:0;color:var(--ink-2)}
|
|
.alt .verdict{font-family:var(--font-mono);font-size:10px;letter-spacing:.1em;text-transform:uppercase;color:var(--clay)}
|
|
footer{border-top:2px solid var(--ink);margin-top:20px;padding-top:22px;font-family:var(--font-mono);font-size:11px;letter-spacing:.06em;color:var(--ink-3);display:flex;justify-content:space-between;gap:20px;flex-wrap:wrap}
|
|
.tm td,.tm th{text-align:center}
|
|
.tm td:first-child,.tm th:first-child{text-align:left}
|
|
.yes{color:var(--l4);font-weight:700}
|
|
.no{color:var(--clay);font-weight:700}
|
|
.kind{font-family:var(--font-mono);font-size:9px;letter-spacing:.09em;text-transform:uppercase;padding:2px 6px;border-radius:2px;white-space:nowrap;border:1px solid var(--rule-strong);color:var(--ink-3)}
|
|
.kind.adv{border-color:var(--clay);color:var(--clay)}
|
|
.routes{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:2px;background:var(--rule);border:1px solid var(--rule);margin:0 0 22px}
|
|
.route{background:var(--surface);padding:16px 18px}
|
|
.route h4{font-family:var(--font-display);font-weight:750;font-size:14px;margin:0 0 6px}
|
|
.route p{font-family:var(--font-display);font-size:12.5px;line-height:1.45;color:var(--ink-2);margin:0;max-width:none}
|
|
.route .tag{font-family:var(--font-mono);font-size:9px;letter-spacing:.1em;text-transform:uppercase;color:var(--brass);display:block;margin-bottom:8px}
|
|
a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-offset:3px}
|
|
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
|
|
|
|
</style>
|
|
<div class="wrap"><header><div class="eyebrow"><span>netkingdom-iam-profile-v0.3</span> <span class="stat">accepted · accepted-1</span> <span>net-kingdom</span> <span>reviewed 2026-08-22</span><span>generated from canonical source — do not edit</span></div><h1>NetKingdom IAM Profile v0.3</h1><p class="sub">Source: <code>net-kingdom · canon/standards/iam-profile_v0.3.md · 9781102e2971d762ae42fdd5085a6647afd1cd66</code></p><p class="sub">Review due: 2027-02-22</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#purpose"><span class="n">·</span>Purpose</a></li><li><a href="#ownership"><span class="n">·</span>Ownership</a></li><li><a href="#design-principles"><span class="n">·</span>Design Principles</a></li><li><a href="#discovery-contract"><span class="n">·</span>Discovery Contract</a></li><li><a href="#required-flows"><span class="n">·</span>Required Flows</a></li><li><a href="#core-claims"><span class="n">·</span>Core Claims</a></li><li><a href="#tenant-claim"><span class="n">·</span>Tenant Claim</a></li><li><a href="#tenant-roles"><span class="n">·</span>Tenant Roles</a></li><li><a href="#assurance-evidence"><span class="n">·</span>Assurance Evidence</a></li><li><a href="#identity-to-authorization-contract"><span class="n">·</span>Identity To Authorization Contract</a></li><li><a href="#token-lifecycle"><span class="n">·</span>Token Lifecycle</a></li><li><a href="#local-development-profile"><span class="n">·</span>Local Development Profile</a></li><li><a href="#emergency-and-break-glass-access"><span class="n">·</span>Emergency And Break-Glass Access</a></li><li><a href="#conformance"><span class="n">·</span>Conformance</a></li><li><a href="#validation-checklist"><span class="n">·</span>Validation Checklist</a></li></ol></nav><main><div class="rule-quote"><p>Minor version. Per ADR-0011's versioning rule, this adds an optional claim and clarifies non-normative guidance — no required claim, validation rule, or previously-issued token is invalidated. Existing v0.2 implementations remain conformant; <code>tenant_roles</code> and the revised Tenant Claim guidance are additive.</p></div>
|
|
<section id="purpose"><h2>Purpose</h2>
|
|
<p>The NetKingdom IAM Profile is the provider-neutral OIDC contract that identity implementations issue and applications consume.</p>
|
|
<p>It defines:</p>
|
|
<ul><li>OIDC discovery and endpoint requirements;</li><li>Authorization Code + PKCE for human login;</li><li>service-account and workload identity token requirements;</li><li>human, service, and agent principal representation;</li><li>tenant, tenant-grouping, and platform-boundary claims;</li><li>tenant capability roles and their carrying mechanism;</li><li>explicit assurance evidence;</li><li>the identity-to-authorization claim contract consumed by flex-auth;</li><li>local-development and emergency-access behavior;</li><li>executable conformance expectations.</li></ul>
|
|
<p>Applications target this profile, not a concrete identity provider. key-cape is the lightweight implementation. Keycloak is the expanded-mode implementation. Both are interchangeable at the application and authorization boundary when they conform to this document.</p>
|
|
</section>
|
|
<section id="ownership"><h2>Ownership</h2>
|
|
<p>NetKingdom owns the core/platform profile. See ADR-0011.</p>
|
|
<p>Downstream systems may define extension scopes, roles, resource names, and tenant policy vocabularies. Those extensions are not part of the core profile unless a future version explicitly adopts them. Extension vocabularies must map back to the core claims in this document before flex-auth or applications consume them.</p>
|
|
</section>
|
|
<section id="design-principles"><h2>Design Principles</h2>
|
|
<ul><li>Consumers trust signed OIDC tokens, not provider-specific sessions.</li><li>Identity providers assert identity and authentication evidence; they do not make final resource authorization decisions.</li><li>The same profile works in lightweight key-cape mode and expanded Keycloak mode.</li><li>Tenancy is explicit. <code>tenant:platform</code> is distinct from tenant planes such as <code>tenant:coulomb</code> and from later tenants grouped per ADR-0013.</li><li>A tenant's onboarding <strong>grouping</strong> (ADR-0013) and its <strong>capability roles</strong> (ADR-0014) are independent axes. Neither is encoded in the other; a tenant's roles may change without renaming its identifier.</li><li>Human, service, and agent principals are distinguishable.</li><li>Assurance evidence is explicit enough for flex-auth policy.</li><li>Local-development issuers are useful but never accepted by production.</li><li>Emergency access is auditable, time-bounded, and reviewable.</li></ul>
|
|
</section>
|
|
<section id="discovery-contract"><h2>Discovery Contract</h2>
|
|
<p>Every IAM Profile implementation MUST expose OIDC discovery at:</p>
|
|
<pre>GET <issuer>/.well-known/openid-configuration</pre>
|
|
<p>The discovery response MUST include:</p>
|
|
<div class="scroll"><table><thead><tr><th>Field</th><th>Requirement</th></tr></thead><tbody><tr><td><code>issuer</code></td><td>Exact issuer identifier used in tokens</td></tr><tr><td><code>authorization_endpoint</code></td><td>Required for human Authorization Code + PKCE</td></tr><tr><td><code>token_endpoint</code></td><td>Required for token exchange and service accounts</td></tr><tr><td><code>jwks_uri</code></td><td>Required for signature validation</td></tr><tr><td><code>userinfo_endpoint</code></td><td>Required when userinfo is supported by the flow</td></tr><tr><td><code>scopes_supported</code></td><td>MUST include <code>openid</code>; SHOULD include <code>profile</code> and <code>email</code></td></tr><tr><td><code>response_types_supported</code></td><td>MUST include <code>code</code></td></tr><tr><td><code>grant_types_supported</code></td><td>MUST include <code>authorization_code</code>; MUST include <code>client_credentials</code> or a documented workload-token exchange for service identities</td></tr><tr><td><code>id_token_signing_alg_values_supported</code></td><td>MUST include the implementation signing algorithm; RS256 is required for v0.2+ conformance</td></tr><tr><td><code>code_challenge_methods_supported</code></td><td>MUST include <code>S256</code></td></tr></tbody></table></div>
|
|
<p>The response SHOULD include <code>end_session_endpoint</code> where logout is supported and <code>claims_supported</code> listing the core claims below.</p>
|
|
<p>Consumers MUST discover endpoints and key material from the issuer metadata instead of hardcoding provider-specific paths.</p>
|
|
</section>
|
|
<section id="required-flows"><h2>Required Flows</h2>
|
|
<h3>Human Interactive Flow</h3>
|
|
<p>Human users authenticate with Authorization Code + PKCE.</p>
|
|
<p>Required properties:</p>
|
|
<ul><li>PKCE with <code>S256</code> is mandatory for browser and CLI clients.</li><li>Implicit flow is not part of the profile.</li><li>MFA or equivalent strong assurance is mandatory for privileged, destructive, platform-root, and emergency access in production.</li><li>Access tokens are short-lived.</li><li>Refresh tokens are allowed only for trusted clients with explicit rotation and revocation.</li></ul>
|
|
<h3>Service Account Flow</h3>
|
|
<p>Service-to-service traffic uses client credentials or a deployment's documented workload identity token-exchange equivalent.</p>
|
|
<p>Required properties:</p>
|
|
<ul><li>Service subjects are stable and named for service plus environment.</li><li>Secrets or workload credentials are delivered through the credential-management standard, not plaintext configuration.</li><li>Tokens include an audience that identifies the target service.</li><li>Tokens carry <code>principal_type: service</code>.</li><li>Service accounts receive only required scopes and roles.</li><li>Credentials are rotated and never shared between environments.</li></ul>
|
|
<h3>Agent Principal Flow</h3>
|
|
<p>Agents are automation principals that may act autonomously or under delegated authority.</p>
|
|
<p>Required properties:</p>
|
|
<ul><li>Tokens carry <code>principal_type: agent</code>.</li><li>Tokens include an <code>agent</code> object with <code>id</code> and <code>mode</code>.</li><li><code>agent.mode</code> is <code>autonomous</code> or <code>delegated</code>.</li><li>Delegated agents MUST identify the delegating actor using <code>actor_sub</code> or an equivalent <code>act.sub</code> claim.</li><li>Agent tokens MUST carry the tenant they operate within.</li><li>Agent tokens MUST include assurance evidence for both the agent credential and any delegated human authority when policy needs it.</li></ul>
|
|
</section>
|
|
<section id="core-claims"><h2>Core Claims</h2>
|
|
<p>Access tokens accepted by production consumers MUST provide the following claims after provider mapping or normalization:</p>
|
|
<div class="scroll"><table><thead><tr><th>Claim</th><th>Type</th><th>Meaning</th></tr></thead><tbody><tr><td><code>iss</code></td><td>string</td><td>OIDC issuer URL or issuer identifier</td></tr><tr><td><code>sub</code></td><td>string</td><td>Stable subject identifier unique within <code>iss</code></td></tr><tr><td><code>aud</code></td><td>string or array</td><td>Intended audience; MUST include the receiving service</td></tr><tr><td><code>exp</code></td><td>number</td><td>Expiry timestamp</td></tr><tr><td><code>iat</code></td><td>number</td><td>Issued-at timestamp</td></tr><tr><td><code>nbf</code></td><td>number</td><td>Not-before timestamp, recommended for production tokens</td></tr><tr><td><code>jti</code></td><td>string</td><td>Token identifier, recommended for audit and replay controls</td></tr><tr><td><code>tenant</code></td><td>string</td><td>Tenant identifier such as <code>tenant:platform</code> or <code>tenant:friendly:binky</code></td></tr><tr><td><code>principal_type</code></td><td>string</td><td><code>human</code>, <code>service</code>, or <code>agent</code></td></tr><tr><td><code>groups</code></td><td>array</td><td>Group memberships, possibly empty</td></tr><tr><td><code>roles</code></td><td>array</td><td>Coarse <strong>identity</strong> roles for the subject, possibly empty</td></tr><tr><td><code>scope</code> or <code>scp</code></td><td>string or array</td><td>Granted OAuth scopes</td></tr><tr><td><code>assurance</code></td><td>object</td><td>Authentication and credential assurance evidence</td></tr></tbody></table></div>
|
|
<p>Recommended human claims:</p>
|
|
<div class="scroll"><table><thead><tr><th>Claim</th><th>Meaning</th></tr></thead><tbody><tr><td><code>preferred_username</code></td><td>Human-readable username</td></tr><tr><td><code>email</code></td><td>Contact identity</td></tr><tr><td><code>name</code></td><td>Display name</td></tr></tbody></table></div>
|
|
<p>Recommended service claims:</p>
|
|
<div class="scroll"><table><thead><tr><th>Claim</th><th>Meaning</th></tr></thead><tbody><tr><td><code>azp</code> or <code>client_id</code></td><td>Authorized client/service identifier</td></tr><tr><td><code>service</code></td><td>Object naming the service and environment</td></tr></tbody></table></div>
|
|
<p>Recommended agent claims:</p>
|
|
<div class="scroll"><table><thead><tr><th>Claim</th><th>Meaning</th></tr></thead><tbody><tr><td><code>agent.id</code></td><td>Stable agent identifier</td></tr><tr><td><code>agent.mode</code></td><td><code>autonomous</code> or <code>delegated</code></td></tr><tr><td><code>actor_sub</code> or <code>act.sub</code></td><td>Delegating subject for delegated agents</td></tr></tbody></table></div>
|
|
<p>Optional claims (new in v0.3):</p>
|
|
<div class="scroll"><table><thead><tr><th>Claim</th><th>Type</th><th>Meaning</th></tr></thead><tbody><tr><td><code>tenant_roles</code></td><td>array</td><td>Cached tenant <strong>capability</strong> roles (<code>PLTF</code>/<code>IAM</code>/<code>VEN</code>/<code>CUS</code>), possibly empty. See "Tenant Roles" below — this is a point-in-time cache, not the authoritative source.</td></tr></tbody></table></div>
|
|
<h3>Role Claim</h3>
|
|
<p>The canonical <strong>subject</strong>-level role claim is <code>roles</code>, an array of strings. This is distinct from <code>tenant_roles</code> (below) — a subject's own coarse identity roles are not the same fact as which capability roles the subject's tenant holds.</p>
|
|
<p>Expanded-mode Keycloak deployments may also expose provider-native roles such as <code>realm_access.roles</code>, but conforming tokens consumed by flex-auth or applications MUST either emit <code>roles</code> directly or pass through a normalizing adapter that produces <code>roles</code>.</p>
|
|
<h3>Scope Vocabulary</h3>
|
|
<p>The core profile defines only OAuth/OIDC base scopes:</p>
|
|
<div class="scroll"><table><thead><tr><th>Scope</th><th>Meaning</th></tr></thead><tbody><tr><td><code>openid</code></td><td>Required for OIDC login</td></tr><tr><td><code>profile</code></td><td>Basic profile claims</td></tr><tr><td><code>email</code></td><td>Email claim where appropriate</td></tr><tr><td><code>offline_access</code></td><td>Refresh-token capable access where explicitly allowed</td></tr></tbody></table></div>
|
|
<p>Hub-, application-, and resource-specific scopes such as <code>hub:*</code>, <code>ops:*</code>, <code>fin:*</code>, or storage actions are downstream extensions. They are valid only when the consuming system defines them and maps them to flex-auth resource/action semantics.</p>
|
|
</section>
|
|
<section id="tenant-claim"><h2>Tenant Claim</h2>
|
|
<p><code>tenant</code> is required for every token accepted by profile consumers.</p>
|
|
<p>Tenant identifiers follow <code>tenant:<grouping>:<name></code>, where <code><grouping></code> is one of the taxonomy ratified by ADR-0013 at identifier creation:</p>
|
|
<pre>trial - test/trial/showcase tenants only
|
|
friendly - known, easily reached, tolerant of experimentation/instability
|
|
single - one-person business entities (freelance consultants)
|
|
small - up to 10 employees at time of onboarding (attoo)
|
|
medium - up to 100 employees (attoo)
|
|
large - up to 1000 employees (attoo)
|
|
enterprise - 1001+ employees (attoo)
|
|
consumer - private individuals
|
|
family - a legal family
|
|
community - a non-legal group of people
|
|
association - a legal association of people
|
|
agentic - financially enabled AI entities</pre>
|
|
<p><code>tenant:platform</code> and <code>tenant:coulomb</code> remain <strong>reserved, ungrouped</strong> identifiers outside this taxonomy: <code>tenant:platform</code> is the platform control-plane tenant, not a business entity being onboarded; <code>tenant:coulomb</code> is the first internal/reference tenant established by ADR-0006, predating this taxonomy. Tenant administration for <code>tenant:coulomb</code> or any grouped tenant must never imply platform-root authority.</p>
|
|
<p>Subjects may have access to multiple tenants, but a token used for a request MUST identify the tenant context for that request. If a client needs to switch tenant context, it obtains a new token or uses an approved token-exchange flow that records the target tenant.</p>
|
|
<p>The grouping segment is an immutable record of the tenant's <strong>onboarding-time</strong> onboarding-risk / entity-shape classification. It remains vocabulary-valid but becomes historical if the tenant's classification later changes. The authoritative current grouping is the <code>grouping</code> field held by <code>tenant-engine</code>; consumers MUST NOT split <code>tenant</code> and treat its middle segment as current policy input. Changing current grouping never renames the tenant. Neither the historical segment nor current grouping gates which capability roles (below) a tenant may hold — see Tenant Roles.</p>
|
|
</section>
|
|
<section id="tenant-roles"><h2>Tenant Roles</h2>
|
|
<p>Tenant <strong>capability roles</strong> are a separate fact from the grouping above and from the subject-level <code>roles</code> claim: <code>PLTF</code>, <code>IAM</code>, <code>VEN</code>, <code>CUS</code> (ratified by ADR-0014), non-exclusive — a tenant may hold several simultaneously, and holding one does not require or restrict any grouping.</p>
|
|
<p><strong>Source of truth:</strong> <code>tenant-engine</code> (<code>canon/standards/tenant-engine-boundary-contract_v0.1.md</code>), not this profile and not any token. <code>tenant-engine</code> records role grants/revocations, their link (if any) to a plan/subscription, and emits domain events on change.</p>
|
|
<p><strong>Carrying mechanism — hybrid, not claim-only:</strong></p>
|
|
<ul><li><code>key-cape</code> (or Keycloak) MAY stamp a cached <code>tenant_roles</code> claim onto an issued token at issuance time, sourced from <code>tenant-engine</code>.</li><li>Consumers MAY trust the cached claim for ordinary, non-privileged decisions.</li><li>Consumers <strong>MUST NOT</strong> trust the cached claim for privileged, destructive, platform-root, secret, credential-vending, or otherwise <code>assurance.level >= aal2</code>-class decisions. Those decisions <strong>MUST</strong> query <code>tenant-engine</code> live for current role state before authorizing the action.</li><li>This bounds staleness for ordinary actions to the issuing token's lifetime (5-30 minutes for service/agent tokens, see Token Lifecycle) while guaranteeing freshness exactly where a stale grant (e.g. <code>VEN</code> surviving a plan cancellation) would matter most.</li></ul>
|
|
<p><code>trial</code>-grouped tenants may hold any capability role without restriction — the grouping exists to showcase, test, and explore every role. Safety for <code>trial</code> tenants is enforced through <code>tenant-engine</code>-owned resource guardrails (spend limits, entity/action counts — reserved, not yet specified), not through role gating.</p>
|
|
</section>
|
|
<section id="assurance-evidence"><h2>Assurance Evidence</h2>
|
|
<p>The canonical assurance claim is <code>assurance</code>.</p>
|
|
<p>It is an object with these fields:</p>
|
|
<div class="scroll"><table><thead><tr><th>Field</th><th>Type</th><th>Meaning</th></tr></thead><tbody><tr><td><code>level</code></td><td>string</td><td><code>aal0</code>, <code>aal1</code>, <code>aal2</code>, <code>aal3</code>, or <code>break_glass</code></td></tr><tr><td><code>methods</code></td><td>array</td><td>Authentication methods, e.g. <code>pwd</code>, <code>otp</code>, <code>webauthn</code>, <code>client_secret</code>, <code>workload_identity</code>, <code>upstream_mfa</code></td></tr><tr><td><code>mfa</code></td><td>boolean</td><td>Whether the authentication included multiple factors or equivalent upstream evidence</td></tr><tr><td><code>source</code></td><td>string</td><td>Provider of the evidence, e.g. <code>key-cape</code>, <code>keycloak</code>, <code>privacyidea</code>, <code>entra</code>, <code>local-identity</code></td></tr><tr><td><code>at</code></td><td>number</td><td>Authentication time, recommended</td></tr></tbody></table></div>
|
|
<p>Level meanings:</p>
|
|
<div class="scroll"><table><thead><tr><th>Level</th><th>Meaning</th></tr></thead><tbody><tr><td><code>aal0</code></td><td>Local/dev or unauthenticated bootstrap evidence; never production privileged</td></tr><tr><td><code>aal1</code></td><td>Single-factor or service credential evidence</td></tr><tr><td><code>aal2</code></td><td>MFA or equivalent strong upstream assurance</td></tr><tr><td><code>aal3</code></td><td>Phishing-resistant or hardware-backed assurance</td></tr><tr><td><code>break_glass</code></td><td>Time-bounded emergency access with post-event review</td></tr></tbody></table></div>
|
|
<p>Privileged, destructive, platform-root, secret, credential-vending, and emergency flows require <code>aal2</code> or stronger unless a policy explicitly permits a narrower service or workload identity path. Emergency access MUST use <code>break_glass</code> and short token lifetimes. This is the same threshold class that gates when <code>tenant_roles</code> MUST be re-validated live against <code>tenant-engine</code> rather than trusted from the token — see Tenant Roles.</p>
|
|
<p>Provider-native claims such as <code>acr</code> and <code>amr</code> may be present, but consumers use <code>assurance</code> as the normalized profile claim.</p>
|
|
</section>
|
|
<section id="identity-to-authorization-contract"><h2>Identity To Authorization Contract</h2>
|
|
<p>flex-auth consumes IAM Profile tokens as normative identity input. flex-auth MUST NOT re-derive identity, tenant, group, role, or assurance facts from provider-specific session state.</p>
|
|
<p>The profile guarantees these inputs for authorization decision envelopes:</p>
|
|
<div class="scroll"><table><thead><tr><th>Decision input</th><th>Source claim</th></tr></thead><tbody><tr><td>Subject</td><td><code>sub</code></td></tr><tr><td>Issuer</td><td><code>iss</code></td></tr><tr><td>Audience</td><td><code>aud</code></td></tr><tr><td>Tenant</td><td><code>tenant</code></td></tr><tr><td>Principal type</td><td><code>principal_type</code></td></tr><tr><td>Groups</td><td><code>groups</code></td></tr><tr><td>Subject roles</td><td><code>roles</code></td></tr><tr><td>Tenant capability roles</td><td><code>tenant_roles</code> (cached); <code>tenant-engine</code> live lookup required for high-stakes decisions</td></tr><tr><td>Scopes</td><td><code>scope</code> or <code>scp</code></td></tr><tr><td>Assurance</td><td><code>assurance</code></td></tr><tr><td>Authorized client</td><td><code>azp</code> or <code>client_id</code>, where present</td></tr><tr><td>Agent/delegation context</td><td><code>agent</code>, <code>actor_sub</code>, or <code>act</code>, where present</td></tr><tr><td>Token lifetime/audit ids</td><td><code>iat</code>, <code>nbf</code>, <code>exp</code>, <code>jti</code>, where present</td></tr></tbody></table></div>
|
|
<p>Authorization decisions are made by flex-auth and its delegated PDP adapters. Identity providers may assert roles or scopes, but those claims are inputs to policy, not final permission to act on a resource.</p>
|
|
</section>
|
|
<section id="token-lifecycle"><h2>Token Lifecycle</h2>
|
|
<p>Recommended production defaults:</p>
|
|
<div class="scroll"><table><thead><tr><th>Token</th><th>Lifetime</th><th>Notes</th></tr></thead><tbody><tr><td>Human access token</td><td>5-15 minutes</td><td>Short-lived bearer token</td></tr><tr><td>Refresh token</td><td>8-12 hours</td><td>Rotated and revoked on logout or suspicion</td></tr><tr><td>Service token</td><td>5-30 minutes</td><td>Reissued by client credentials or workload identity</td></tr><tr><td>Agent token</td><td>5-30 minutes</td><td>Shorter when delegated or platform-scoped</td></tr><tr><td>Emergency token</td><td>5-15 minutes</td><td>Requires incident/review record</td></tr></tbody></table></div>
|
|
<p>Consumers MUST reject expired tokens and tokens with invalid issuer, audience, signature, <code>nbf</code>, or algorithm. Clock skew tolerance SHOULD be small, normally no more than 60 seconds.</p>
|
|
<p>JWKS material may be cached, but consumers MUST tolerate key rotation by refreshing JWKS when a token uses an unknown <code>kid</code>.</p>
|
|
</section>
|
|
<section id="local-development-profile"><h2>Local Development Profile</h2>
|
|
<p>A local file-backed provider may be used for development, tests, and bootstrap contexts where the full platform is unavailable.</p>
|
|
<p>It MUST:</p>
|
|
<ul><li>expose OIDC discovery;</li><li>issue signed JWTs;</li><li>support deterministic test users and service accounts;</li><li>use local-only issuer URLs or a clearly local issuer identifier;</li><li>mark tokens as local/development through issuer, audience, or assurance evidence;</li><li>be rejected by production consumers.</li></ul>
|
|
<p>Production consumers MUST reject:</p>
|
|
<ul><li>issuer <code>local-identity</code>;</li><li><code>http://</code> issuers;</li><li>loopback issuers such as <code>localhost</code> or <code>127.0.0.1</code>;</li><li>tokens with <code>assurance.level: aal0</code>;</li><li>tokens where the environment marks the issuer as local/dev.</li></ul>
|
|
</section>
|
|
<section id="emergency-and-break-glass-access"><h2>Emergency And Break-Glass Access</h2>
|
|
<p>Emergency access is allowed only as a break-glass path.</p>
|
|
<p>Requirements:</p>
|
|
<ul><li>Emergency identities are disabled by default.</li><li>Activation requires an incident, decision, or human-recorded review reference.</li><li>Tokens are short-lived and carry the <code>emergency</code> role.</li><li>Tokens carry <code>assurance.level: break_glass</code>.</li><li>Every emergency action emits an audit/progress/incident event.</li><li>Emergency access is reviewed after use and then disabled again.</li></ul>
|
|
<p>Emergency access MUST NOT bypass audit logging or flex-auth policy.</p>
|
|
</section>
|
|
<section id="conformance"><h2>Conformance</h2>
|
|
<p>An implementation conforms to IAM Profile v0.3 when it passes the executable conformance suite in:</p>
|
|
<pre>tools/iam-profile-conformance/</pre>
|
|
<p>The suite validates:</p>
|
|
<ul><li>discovery document completeness;</li><li>PKCE <code>S256</code> advertisement and rejection of authorization requests that omit a code challenge;</li><li>JWKS structure and key ids;</li><li>token issuer, audience, expiry, <code>nbf</code>, <code>iat</code>, and RS256 signature;</li><li>tenant, principal type, groups, roles, scopes, and assurance claim shape;</li><li><code>tenant_roles</code> claim shape when present (array of ratified role strings);</li><li>agent and delegated-agent claim shape;</li><li>local-development issuer rejection in production mode.</li></ul>
|
|
<p>Conformance must be runnable against both key-cape lightweight issuers and Keycloak expanded-mode issuers. Implementations may add provider adapters, but the token consumed by applications and flex-auth must match the core claim contract above. <code>tenant_roles</code> conformance does not require an implementation to emit the claim (it is optional); when emitted, it must match the ratified vocabulary.</p>
|
|
</section>
|
|
<section id="validation-checklist"><h2>Validation Checklist</h2>
|
|
<p>A service or implementation is profile-ready when:</p>
|
|
<ul><li>it reads OIDC discovery rather than hardcoding endpoints;</li><li>it validates issuer, audience, expiry, <code>nbf</code>, algorithm, and signature;</li><li>it refreshes JWKS on unknown <code>kid</code>;</li><li>it supports Authorization Code + PKCE for human login;</li><li>it supports service-account or workload identity tokens;</li><li>it emits <code>tenant</code>, <code>principal_type</code>, <code>groups</code>, <code>roles</code>, <code>scope</code>/<code>scp</code>, and <code>assurance</code>;</li><li>it uses the ADR-0013 grouping vocabulary for new tenant identifiers;</li><li>if it consumes <code>tenant_roles</code>, it treats the claim as a cache and re-validates live against <code>tenant-engine</code> before any <code>aal2</code>-class decision;</li><li>it maps provider-native claims into the canonical core claims;</li><li>it rejects local-development issuers in production;</li><li>it logs emergency access with a durable audit trail;</li><li>flex-auth receives identity facts from the profile, not from provider-specific sessions.</li></ul>
|
|
</section><footer><span>netkingdom-iam-profile-v0.3 · accepted-1 · accepted</span><span>net-kingdom · canon/standards/iam-profile_v0.3.md · 9781102e2971d762ae42fdd5085a6647afd1cd66</span></footer></main></div></div></html>
|