railiance-platform/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md

---
id: RPF-WP-0026
type: workplan
title: "Adopt canonical flex-auth credential-grant checks"
domain: financials
repo: railiance-platform
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
related:
  - FLEX-WP-0012
origin: routed
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e"
---

# RPF-WP-0026 — canonical flex-auth credential-grant checks

## Goal

Adopt flex-auth's single canonical `POST /v1/check` decision surface for
credential-grant preflight without exposing credential values or adding a
consumer-specific flex-auth endpoint.

## T01 — Resolve translation ownership

```task
id: RPF-WP-0026-T01
status: done
priority: high
state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"
```

The operator explicitly approved Option A in State Hub decision
`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
normalization belong here, before the flex-auth policy boundary.

## T02 — Implement the canonical request and response

```task
id: RPF-WP-0026-T02
status: done
priority: high
state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"
```

Change the helper default to `/v1/check`, emit the coordinated
`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
`requested_ttl_seconds` as an integer, and accept only `effect: allow`.

Completed in source. Actor classes map to canonical subject types (`Human`,
`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
carried in context. Missing, deny, redact, audit-only, and not-applicable
effects all fail closed. An allow also requires a non-empty decision id,
evaluator provenance, and subject/resource binding back to the request.

## T03 — Verify and route the contract

```task
id: RPF-WP-0026-T03
status: done
priority: medium
state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"
```

Exercise focused allow and deny tests, validate the complete repository suite,
and route the adopted mapping to flex-auth without requesting live credentials
or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs,
credential-catalog validation, and the complete 146-test offline suite passing.
No flex-auth production endpoint was called and no credential was issued.