id: CCR-2026-0016
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Glas local Claude workload Anthropic API key
status: in_flight
created: '2026-09-05'
updated: '2026-09-05'
in_flight:
  missing_fields:
  - openbao.policy_file
  - openbao.auth
  blocking_reason: Anthropic organization and workspace budget await user input; the sandbox owner machine identity and protected delivery path have not been verified. No live grant or key exists from this request.
  owner: railiance-platform
requester:
  agent: codex
  reason: User selected a dedicated Anthropic workload API key for GLAS-WP-0012 and SAND-WP-0015. Establish custody and owner delivery before the real local Claude proof.
review:
  required: true
  required_approvers:
  - platform-operator
  - sand-boxer-owner
  comments:
  - at: '2026-09-05'
    reviewer: user via chat
    decision: authentication_model_selected
    comment: User requested establishment of an Anthropic workload API key. This records the chosen authentication model; final machine bindings are not yet known.
target:
  domain: infotech
  tenant: glas-harness
  workload: sand-boxer-claude-agent-dev
  environment: production
  purpose: Dedicated Claude Code inference for the Glas local agent-dev profile, delivered by the sandbox owner.
openbao:
  mount: platform
  kv_path: platform/workloads/glas-harness/claude-agent-dev
  fields:
  - ANTHROPIC_API_KEY
  metadata_read: false
  policy_name: workload-kv-read-glas-claude-agent-dev
access_frontdoor:
  type: sandbox-owner
  catalog_id: glas-claude-agent-dev-anthropic
  selector: Glas local Claude Anthropic workload API key
  readiness: pending-review
  resolvable: false
delivery:
  surface: owner-exec
  target: Sand-boxer delivers ANTHROPIC_API_KEY only to the selected Claude workload; neither the Glas caller nor the runtime receives an OpenBao token.
risk:
  classification: high
  notes:
  - Proposed KV coordinates and catalog selector are reserved design names, not surveyed live objects.
  - Provider credential can incur API charges; use a dedicated workspace and user-selected budget.
  - Use a workspace-scoped service account key; organization administration is outside the workload grant.
  - OpenBao token expiration does not expire the provider key. Provider revocation is required for compromise.
  - Owner environment injection can expose the key to descendants within that workload; it is not per-process secrecy against workload code.
verification:
  positive:
  - Confirm provider organization, workspace, service account, key identifier and expiration using metadata only.
  - Exact authenticated sandbox owner can read only the intended data entry and deliver the field without logging it.
  - Bounded real Claude proof succeeds through enforced provider egress and removes private state on teardown.
  negative:
  - Wrong owner identity, sibling KV path, metadata read, parent listing and workload writes are denied.
  - Generic coding-agent identity cannot retrieve the credential directly.
  - No credential or OpenBao token appears in execution replies, artifacts, source tree or State Hub.
  - A revoked predecessor provider key fails authentication after controlled rotation.
  activation_conditions:
  - User confirms Anthropic organization and workspace budget; provider service account and key are created through attended Console custody.
  - Confirm actual sandbox host service identity and auth binding; review exact read policy and separate protected custody writer before apply.
  - Seed KV with compare-and-set zero through attended custody; never enter values in chat or command arguments.
  - Positive and negative access, owner delivery and provider authentication evidence pass before route activation.
lifecycle:
  deactivate: Disable the owner route and provider key; revoke outstanding OpenBao reader tokens. Preserve KV history under platform retention rules.
  rotate: Create a replacement provider key, write with expected-version CAS, stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove its denial.
  compromised: Disable the provider key immediately, stop affected runs and owner route, revoke Bao leases, replace forward through protected custody and record non-secret incident evidence.
state_hub:
  workplan_id: GLAS-WP-0012
  task_id: GLAS-WP-0012-T02