CCR-2026-0053: approved (platform-owner, net-kingdom-owner) and binding confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml

@@ -3,21 +3,35 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom Authelia directory bind (svc-authelia) delivery
-status: proposed
+status: approved
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
   agent: claude-code
   reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052):
     move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into
-    platform custody, so its rotation needs neither a decrypted custody copy nor a person
-    handling the value.'
+    platform custody, so its rotation needs neither a decrypted custody copy nor a
+    person handling the value.'
 review:
   required: true
   required_approvers:
   - platform-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-10-31T09:03:46+00:00'
+    reviewer: platform-owner
+    decision: approved
+    comment: 'Approved as proposed: read-only svc-authelia lane, CAS=0 from live value,
+      ESO Merge of ldap_password only.'
+  - at: '2026-10-31T09:03:53+00:00'
+    reviewer: net-kingdom-owner
+    decision: approved
+    comment: Approved as proposed for NK-WP-0056-T04.
+  - at: '2026-10-31T09:04:03+00:00'
+    reviewer: platform-owner
+    decision: binding_confirmed
+    comment: 'Binding confirmed: ServiceAccount net-kingdom-svc-authelia-bind-eso
+      in namespace sso only, audience openbao, as declared in net-kingdom sso-mfa/k8s/authelia/bind-eso.yaml.'
 target:
   domain: infotech
   tenant: platform
@@ -51,7 +65,7 @@ openbao:
       - net-kingdom-svc-authelia-bind-eso
       service_account_namespaces:
       - sso
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
 access_frontdoor:
   type: platform-owner
   catalog_id: net-kingdom-svc-authelia-bind
@@ -61,10 +75,10 @@ lifecycle:
   deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret),
     then withdraw the role and policy; the KV entry stays as custody until the founder's
     copy is confirmed current.
-  rotate: Change the svc-authelia password in LLDAP and write the new value as the next
-    KV version with CAS on the current version; ESO projects it and Authelia is restarted,
-    because it reads ldap_password only at start-up. Until NK-WP-0056 executors exist
-    this is founder-run.
+  rotate: Change the svc-authelia password in LLDAP and write the new value as the
+    next KV version with CAS on the current version; ESO projects it and Authelia
+    is restarted, because it reads ldap_password only at start-up. Until NK-WP-0056
+    executors exist this is founder-run.
   compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly),
     then rotate as above; fence the reader role if its boundary is in doubt.
 delivery:
@@ -87,8 +101,8 @@ risk:
     Merge projects only ldap_password; the reader policy cannot reach any other path.
   - Initial KV write is CAS=0 with the value already live in the Secret and the founder's
     custody; no rotation happens in this request. An existing different KV value refuses.
-  - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so the
-    projected value cannot belong to another account.
+  - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so
+    the projected value cannot belong to another account.
   - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
     before the first write.
   - Node root, ESO administration and platform-admin remain inside this credential