railiance-platform/docs/evidence/agent-high-risk-boundary-2026-08-21.md

Agent high-risk OpenBao boundary — 2026-08-21

Scope

This is capabilities and metadata evidence for RAILIANCE-WP-0022. No credential value was read, no token was minted, and no operator role was modified.

Source and live coverage

• State Hub message 828e4903-30fe-4903-acfd-cd2ecdda437d reported that the live agent-high-risk-boundary lacked the Core Hub path and that six other concrete high-risk catalog paths were absent from both source and live.
• Source now denies KV-v2 data and permits metadata only for all concrete high-risk catalog paths. Pattern-only and non-KV lanes do not generate an invented address.
• Under attended platform-admin OIDC, OpenBao accepted the updated policy. A normalized readback matched the source file.
• The ops-warden audit used policy_source: server and reported 17 high-risk lanes: 12 covered catalog entries, zero uncovered, and five with no concrete KV address. The policy itself contains 12 unique deny paths because two catalog entries share the Binky IMAP path and Core Hub is an additional reviewed deny without a catalog lane.

Attachment audit and residual blocker

A metadata-only scan listed and read role configuration under netkingdom OIDC, Kubernetes auth, AppRole, and token roles. It found:

• roles attaching agent-high-risk-boundary: 0;
• roles combining it with any workload-kv-read-* policy: 0.

The live policy is therefore complete but is not automatically attached to a coding-agent identity. The documented manual short-lived token example is not a standing identity and carries no workload-read policy. Attaching the boundary to platform-admin would incorrectly constrain the attended operator role and erase the human/agent distinction, so that change was not made.

The remaining work is an identity-owner decision: define a distinct coding- agent issuance path, attach the boundary, and prove that deny wins when a workload read policy is also present. A versioned generated list of concrete high-risk deny paths is also requested from ops-warden so policy coverage does not depend on manual catalog transcription.