railiance-platform/credential-grants/catalog.yaml

version: 1
updated: "2026-08-13"
owner_repo: railiance-platform
owner_domain: financials
workplan_id: RAILIANCE-WP-0005
state_hub_workstream_id: 2731fece-6c49-45b8-ab8a-4ea6c04ac603

delivery_modes:
  allowed_known:
    - exec-env
    - response-wrap
    - local-token-file
    - kubernetes-auth
  denied_known:
    - chat
    - state-hub-body
    - git
    - command-line-token-argument
    - llm-prompt

grant_classes:
  - self-service
  - approval-required
  - break-glass

grants:
  - id: rapp-postgres/audit-core-runtime
    title: audit-core runtime PostgreSQL lease
    rapp_id: rapp-postgres
    status: active
    grant_class: self-service
    credential_type: openbao-database-credential
    issuer: openbao
    audience: audit-core
    description: Short-lived runtime connection to the audit-core database.
    openbao:
      namespace: openbao
      token_role: audit-core-runtime-broker
      issuer_policy: credential-broker-audit-core-runtime-issuer
      policies: [credential-broker-audit-core-runtime]
      disallowed_policies: [root, platform-admin]
      mount_paths: [database/creds/audit-core-runtime]
    database:
      role: audit-core-runtime
      host: platform-pg-rw.databases.svc.cluster.local
      port: 5432
      name: audit_core
      env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
    ttl: {default: 15m, max: 1h, renewable: false, requires_human_above: 1h}
    actors:
      allowed_types: [human-operator, approved-agent, ci-runner]
      required_subject_binding: keycape-or-kubernetes-service-account
    authorization:
      flex_auth_required: false
      flex_auth_mode: optional-preflight
      approval_required: false
      purpose_required: true
      allowed_purpose_examples: [audit-core-runtime]
    delivery:
      allowed: [exec-env]
      preferred: exec-env
      denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
      exec_env: {child_only: true, redact_logs: true}
    audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
    revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}

  - id: rapp-postgres/audit-core-migration
    title: audit-core migration PostgreSQL lease
    rapp_id: rapp-postgres
    status: active
    grant_class: self-service
    credential_type: openbao-database-credential
    issuer: openbao
    audience: audit-core
    description: Short-lived migration connection to the audit-core database.
    openbao:
      namespace: openbao
      token_role: audit-core-migration-broker
      issuer_policy: credential-broker-audit-core-migration-issuer
      policies: [credential-broker-audit-core-migration]
      disallowed_policies: [root, platform-admin]
      mount_paths: [database/creds/audit-core-migration]
    database:
      role: audit-core-migration
      host: platform-pg-rw.databases.svc.cluster.local
      port: 5432
      name: audit_core
      env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
    ttl: {default: 10m, max: 30m, renewable: false, requires_human_above: 30m}
    actors:
      allowed_types: [human-operator, approved-agent, ci-runner]
      required_subject_binding: keycape-or-kubernetes-service-account
    authorization:
      flex_auth_required: false
      flex_auth_mode: optional-preflight
      approval_required: false
      purpose_required: true
      allowed_purpose_examples: [audit-core-migration]
    delivery:
      allowed: [exec-env]
      preferred: exec-env
      denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
      exec_env: {child_only: true, redact_logs: true}
    audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
    revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}

  - id: keycape/client-secret-generate
    title: KeyCape confidential-client secret generation in custody
    status: pilot
    grant_class: approval-required
    credential_type: openbao-token
    issuer: openbao
    audience: railiance-platform-credential-broker
    description: >
      RPF-WP-0054 / CCR-2026-0040. Short-lived token the broker uses inside its
      own process to create platform/workloads/keycape/<client_id> once (CAS 0)
      for an accepted oidc-browser-relying-party case. Create-only: it cannot
      update, read values, write metadata, list or delete. The generated value
      never leaves the broker process and the bao child's stdin; the caller gets a
      receipt only. Founder decision 2026-10-09 (RPF-WP-0054-T02 option A).
    openbao:
      namespace: openbao
      token_role: keycape-client-secret-generate
      issuer_policy: credential-broker-keycape-client-secret-generate-issuer
      policies:
        - keycape-client-secret-generate
      disallowed_policies:
        - root
        - platform-admin
      mount_paths:
        - platform/data/workloads/keycape/+
        - platform/metadata/workloads/keycape/+
    ttl:
      default: 5m
      max: 5m
      renewable: false
      requires_human_above: 5m
    actors:
      allowed_types:
        - human-operator
      required_subject_binding: auth/netkingdom/role/credential-broker-keycape-client-secret-generate
      # CCR-2026-0043: human net-kingdom-admins membership and /assurance/level=aal2.
    authorization:
      flex_auth_required: false
      flex_auth_mode: optional-preflight
      approval_required: true
      purpose_required: true
      allowed_purpose_examples:
        - oidc-browser-relying-party-mint-secret
    delivery:
      allowed:
        - exec-env
      preferred: exec-env
      denied:
        - chat
        - state-hub-body
        - git
        - command-line-token-argument
        - llm-prompt
      exec_env:
        variable: VAULT_TOKEN
        child_only: true
        redact_logs: true
    audit:
      openbao_audit_required: true
      state_hub_metadata_allowed: true
      record_secret_values: false
      metadata_fields:
        - grant_id
        - actor
        - subject
        - purpose
        - case_ref
        - client_id
        - kv_version
        - lease_accessor
        - status
    revocation:
      required: true
      by_accessor: true
      on_exec_exit: true
      on_denied_request: false
  - id: ops-warden/warden-sign
    title: Ops Warden OpenBao SSH signing smoke token
    status: pilot
    grant_class: self-service
    credential_type: openbao-token
    issuer: openbao
    audience: ops-warden
    description: >
      Short-lived OpenBao child token for ops-warden SSH signing smoke tests.
      The token may only use the warden-sign policy and must not be treated as
      an ops-warden-owned secret.
    openbao:
      namespace: openbao
      token_role: warden-sign
      issuer_policy: credential-broker-warden-sign-issuer
      policies:
        - warden-sign
      disallowed_policies:
        - root
        - platform-admin
      mount_paths:
        - ssh/sign/adm-role
        - ssh/sign/agt-role
        - ssh/sign/atm-role
        - ssh/roles
    ttl:
      default: 15m
      max: 1h
      renewable: false
      requires_human_above: 1h
    actors:
      allowed_types:
        - human-operator
        - approved-agent
        - ci-runner
      required_subject_binding: keycape-or-kubernetes-service-account
    authorization:
      flex_auth_required: false
      flex_auth_mode: optional-preflight
      approval_required: false
      purpose_required: true
      allowed_purpose_examples:
        - flex-auth-openbao-smoke
        - ops-warden-production-sign-smoke
    delivery:
      allowed:
        - exec-env
        - response-wrap
        - local-token-file
        - kubernetes-auth
      preferred: exec-env
      denied:
        - chat
        - state-hub-body
        - git
        - command-line-token-argument
        - llm-prompt
      exec_env:
        variable: VAULT_TOKEN
        child_only: true
        redact_logs: true
      response_wrap:
        ttl: 5m
        unwrap_once: true
      local_token_file:
        directory: .local/credential-leases
        mode: "0600"
      kubernetes_auth:
        mount: auth/kubernetes
        role: credential-broker-warden-sign
        audience: openbao
        service_account_names:
          - credential-broker
          - ops-warden-smoke
        namespaces:
          - openbao
          - ops-warden
    audit:
      openbao_audit_required: true
      state_hub_metadata_allowed: true
      record_secret_values: false
      metadata_fields:
        - grant_id
        - actor
        - subject
        - purpose
        - requested_ttl
        - issued_ttl
        - delivery_mode
        - lease_accessor
        - decision_id
        - status
    revocation:
      required: true
      by_accessor: true
      on_exec_exit: true
      on_denied_request: false