---
id: RAILIANCE-WP-0028
type: workplan
title: "Adopt canonical flex-auth credential-grant checks"
domain: financials
repo: railiance-platform
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
related:
  - FLEX-WP-0012
origin: routed
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
state_hub_workstream_id: "022dda1f-8772-57ad-862e-672924455f11"
---

# RAILIANCE-WP-0028 — canonical flex-auth credential-grant checks

## Goal

Adopt flex-auth's single canonical `POST /v1/check` decision surface for
credential-grant preflight without exposing credential values or adding a
consumer-specific flex-auth endpoint.

## T01 — Resolve translation ownership

```task
id: RAILIANCE-WP-0028-T01
status: done
priority: high
state_hub_task_id: "cfec3a0a-a198-580a-988b-4b2d7bac206c"
```

The operator explicitly approved Option A in State Hub decision
`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
normalization belong here, before the flex-auth policy boundary.

## T02 — Implement the canonical request and response

```task
id: RAILIANCE-WP-0028-T02
status: done
priority: high
state_hub_task_id: "971f243a-a6cd-5a3a-965a-8191c51c7577"
```

Change the helper default to `/v1/check`, emit the coordinated
`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
`requested_ttl_seconds` as an integer, and accept only `effect: allow`.

Completed in source. Actor classes map to canonical subject types (`Human`,
`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
carried in context. Missing, deny, redact, audit-only, and not-applicable
effects all fail closed. An allow also requires a non-empty decision id,
evaluator provenance, and subject/resource binding back to the request.

## T03 — Verify and route the contract

```task
id: RAILIANCE-WP-0028-T03
status: done
priority: medium
state_hub_task_id: "60725d60-ae38-5fe8-971f-8c714261fd1d"
```

Exercise focused allow and deny tests, validate the complete repository suite,
and route the adopted mapping to flex-auth without requesting live credentials
or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs,
credential-catalog validation, and the complete 146-test offline suite passing.
No flex-auth production endpoint was called and no credential was issued.