The account task set groups: [] with append: false, so the next run would
have removed custodian-agt from gated-executor's exchange group. Allowed
groups are now an explicit per-account inventory list, refused if forbidden,
and asserted as the exact set by goss; container test covers an unlisted group.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
Map SSH certificate principal agt-custodian to a dedicated custodian-agt
account on Railiance01 only, converged by ssh_ca_host (tag
restricted_agent_account): locked password, home 0700, no supplementary
groups, no sudoers entry, no authorized_keys, and an sshd Match drop-in
(05-restricted-agents.conf) with publickey only and all forwarding, tunnel
and user RC off. A separate goss spec asserts the posture, including that
the account cannot read the k3s kubeconfig and the sshd -T effective config.
Offline tests (optional real-sshd container check). Existing tegwick
mappings unchanged; their retirement is RAIL-HO-WP-0014-T03.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
