id: CCR-2026-0043
kind: credential-change-request
schema_version: 1
request_type: broker-issuer-binding
title: Operator OIDC role for the keycape-client-secret-generate broker issuer (net-kingdom-admins,
  aal2)
status: applied
created: '2026-10-10'
updated: '2026-10-10'
requester:
  agent: railiance-platform
  reason: RPF-WP-0054-T05. ops-warden (23985370) names the caller as the human operator
    who runs warden case run, using their own OIDC session. Founder chose net-kingdom-admins
    + aal2 on 2026-10-10. The issuer policy is live from CCR-2026-0040.
review:
  required: true
  required_approvers:
  - platform-owner
  - key-cape-owner
  comments:
  - at: '2026-10-10T08:27:32+00:00'
    reviewer: platform-owner, key-cape-owner (founder Bernd Worsch)
    decision: approved
    comment: 'Approve issuer binding for keycape-client-secret-generate: net-kingdom-admins
      + aal2 (RPF-WP-0054).'
  - at: '2026-10-10T08:27:32+00:00'
    reviewer: founder
    decision: binding_confirmed
    comment: groups=[net-kingdom-admins] and /assurance/level=aal2, same binding as
      CCR-2026-0034.
target:
  domain: infotech
  tenant: platform
  workload: credential-broker
  environment: production
  purpose: Let a net-kingdom-admins member with a verified second factor log in for
    15 minutes with only the broker issuer policy, so credential.py generate can mint
    the create-only keycape/client-secret-generate token.
openbao:
  issuer_policy: credential-broker-keycape-client-secret-generate-issuer
  auth:
    method: oidc
    mount: netkingdom
    role: credential-broker-keycape-client-secret-generate
    role_file: openbao/auth/credential-broker-keycape-client-secret-generate-oidc-role.json
    bound_claims_confirmed: true
founder_confirmation_items:
- bound_claims_confirmed stays false until the founder confirms groups=[net-kingdom-admins]
  and /assurance/level=aal2, the same binding as CCR-2026-0034 (key-cape b2ed890f).
- The role carries only the issuer policy. It cannot read or write KV; it can mint
  keycape-client-secret-generate tokens through that token role, and look up and revoke
  tokens by accessor.
- Loopback CLI callbacks only (no UI callback); 15m with unlimited uses inside that
  lifetime (a limited-use token cannot create the child grant token), no default policy.
access_frontdoor:
  type: none
  catalog_id: none
risk:
  level: medium
  notes:
  - Membership of net-kingdom-admins is the access decision; that group already holds
    the KeyCape operator reader (CCR-2026-0034).
  - Worst case within 15m is unused keycape/<client_id> entries; existing entries
    cannot be overwritten (CCR-2026-0040 is create-only).
verification:
  positive:
  - Readback after apply matches source for the role (done by applier-apply; prints
    nothing).
  - A member with aal2 logs in with role credential-broker-keycape-client-secret-generate
    and the token's policies are exactly [credential-broker-keycape-client-secret-generate-issuer].
  negative:
  - A non-member or a member without aal2 cannot obtain the role.
  - The issuer token is denied on platform/* and on token creation through any other
    role.
  activation_conditions:
  - Founder approval (two reviews) and bound_claims_confirmed true.
  - CCR-2026-0040 applied (done 2026-10-09).
  evidence:
  - at: '2026-10-10T08:27:38+00:00'
    actor: founder
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
    - 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
    - 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
    - Readback matched source for the role.
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-10-10T09:15:56+00:00'
    actor: founder
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
    - 'Issuer policy confirmed live and matching source: sys/policies/acl/credential-broker-keycape-client-secret-generate-issuer'
    - 'OIDC role metadata write: auth/netkingdom/role/credential-broker-keycape-client-secret-generate'
    - Readback matched source for the role.
    - No secret values were read, written, printed, or accepted in argv.
lifecycle:
  deactivate: Delete auth/netkingdom/role/credential-broker-keycape-client-secret-generate.
  rotate: Not applicable (no stored credential).
  compromised: Delete the role, revoke issued tokens; review keycape/ metadata for
    entries without an accepted case.
state_hub:
  workplan: RPF-WP-0054
  task: RPF-WP-0054-T05