From 01bf010fa661f68efc4d4369e232c2acf6b81637 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 24 Sep 2026 09:56:43 +0200 Subject: [PATCH] Name access-engine as the only authorization decision point. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f --- INTENT.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/INTENT.md b/INTENT.md index d099365..c8b4637 100644 --- a/INTENT.md +++ b/INTENT.md @@ -12,7 +12,8 @@ interfaces, and dependencies so humans and agents can answer questions like: - Which service provides runtime secrets? - Which repos consume the NetKingdom IAM Profile? -- What breaks if the flex-auth decision envelope changes? +- What breaks if the access-engine decision envelope changes? The repository + is still `flex-auth`. - Which workloads require OpenBao KV, dynamic database credentials, or object-storage credential vending? - Which dependencies are declared, missing, stale, or boundary-violating? @@ -99,7 +100,7 @@ local declarations. A deployable or callable unit produced by a repository. A repo may produce zero or more services. -Examples: OpenBao, key-cape, flex-auth API, Topaz deployment, artifact-store. +Examples: OpenBao, key-cape, the access-engine API (repository `flex-auth`), Topaz deployment, artifact-store. ### Capability @@ -186,7 +187,8 @@ It complements: - `railiance-platform`, which deploys shared S3 services such as OpenBao, PostgreSQL, Valkey, and object storage. - `net-kingdom`, which owns identity, credential, and security architecture. -- `flex-auth`, which owns authorization policy and decision semantics. +- `access-engine` (repository `flex-auth`), which owns authorization policy + and decision semantics. It is the only decision point. ## Non-Goals @@ -224,7 +226,7 @@ Show all consumers of OpenBao. Show missing providers for production Railiance. Show every service that depends on NetKingdom identity claims. Show all interfaces crossing from S3 platform services into S5 applications. -Show blast radius for changing flex-auth decision envelope v1. +Show blast radius for changing the access-engine decision envelope v1. Show runtime readiness for tenant:coulomb onboarding. ```