tegwick
b9349782f4
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ec5-7e2b-7743-ac08-719e1b0f42e2
91 lines
3.3 KiB
YAML
91 lines
3.3 KiB
YAML
# Security Genome record for qonto-assistant.
|
|
#
|
|
# Schema per kings-guard/specs/NetKingdomImmuneArchitecture.md §9.1
|
|
# ("Minimum Genome Record"). King's Guard now consumes this source's structured
|
|
# audit events; the adjacent cadence declaration supplies stream-completeness
|
|
# semantics without making the consumer an authority for source intent.
|
|
|
|
security_genome_record:
|
|
id: kg:genome:qonto-assistant
|
|
version: 0.1.0
|
|
|
|
ownership:
|
|
tenant_id: binky
|
|
accountable_owner: bernd.worsch
|
|
operational_owner: qonto-assistant
|
|
|
|
purpose:
|
|
intent: >
|
|
Sole holder of the company Qonto bank API credential; exposes
|
|
read-only finance capabilities (org summary, transactions,
|
|
CostRunRate hints) to authorized agent harnesses and operators via a
|
|
governed REST + MCP surface, so no client ever holds the bank key
|
|
directly.
|
|
criticality: high
|
|
|
|
identities:
|
|
workload_identity: "key-cape JWT verification supported; runtime enforcement is configuration-bound"
|
|
deployment_identity: "TBD — pending Railiance placement decision"
|
|
|
|
capabilities:
|
|
provides:
|
|
- finance.qonto.read
|
|
consumes:
|
|
- openbao-secret.read # tenants/binky/qonto-api
|
|
- qonto-thirdparty-api.read
|
|
|
|
communication:
|
|
ingress:
|
|
- caller: facade-activator # not yet built — see docs/SecurityPractice.md §6
|
|
protocol: https
|
|
egress:
|
|
- destination: openbao
|
|
protocol: https
|
|
- destination: qonto-thirdparty-api
|
|
protocol: https
|
|
# No other egress is expected or permitted. Any additional outbound
|
|
# destination observed at runtime is, by definition, a deviation from
|
|
# this genome.
|
|
|
|
data:
|
|
classifications:
|
|
- tenant-confidential
|
|
- financial
|
|
persistence: ephemeral
|
|
export_allowed: false
|
|
|
|
provenance:
|
|
signed_artifact_required: false # not yet implemented fleet-wide
|
|
approved_registry: "TBD"
|
|
sbom_required: false # not yet implemented; tracked as a gap
|
|
reproducible_build_preferred: true
|
|
|
|
expected_behavior:
|
|
max_request_rate: "per QONTO_RATE_LIMIT_REQUESTS / QONTO_RATE_LIMIT_WINDOW_SECONDS (config.py)"
|
|
external_network_access: false # beyond the two declared egress destinations
|
|
interactive_shell: prohibited
|
|
privilege_escalation: prohibited
|
|
|
|
recovery:
|
|
redeployable: true
|
|
maximum_recovery_time: PT5M # stateless; cold-start dominated by scale-to-zero wake latency
|
|
maximum_data_loss: PT0S # no persisted state
|
|
|
|
tolerances:
|
|
- id: local-dev-shared-secret-auth
|
|
description: >
|
|
QONTO_ASSISTANT_MCP_TOKEN shared-secret bearer auth is tolerated
|
|
only for fixture-backed local development, never for a deployment
|
|
holding real Qonto credentials.
|
|
expires_at: null # revisit once key-cape integration (QONTO-WP-0004) lands
|
|
- id: self-asserted-actor-claims
|
|
description: >
|
|
X-Actor-* headers are self-asserted, not yet cryptographically
|
|
bound to verified identity. Tolerated until key-cape/flex-auth
|
|
integration (QONTO-WP-0004) closes this.
|
|
expires_at: null
|
|
|
|
# Source emission claim for the load-bearing deny observation class. The full
|
|
# machine-readable declaration is kept separate so consumers can ingest it
|
|
# without interpreting the genome schema.
|
|
audit_emission_cadence: audit-emission-cadence.yaml
|