43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Agent high-risk OpenBao boundary — 2026-08-21
|
|
|
|
## Scope
|
|
|
|
This is capabilities and metadata evidence for `RAILIANCE-WP-0022`. No
|
|
credential value was read, no token was minted, and no operator role was
|
|
modified.
|
|
|
|
## Source and live coverage
|
|
|
|
- State Hub message `828e4903-30fe-4903-acfd-cd2ecdda437d` reported that the
|
|
live `agent-high-risk-boundary` lacked the Core Hub path and that six other
|
|
concrete high-risk catalog paths were absent from both source and live.
|
|
- Source now denies KV-v2 data and permits metadata only for all concrete
|
|
high-risk catalog paths. Pattern-only and non-KV lanes do not generate an
|
|
invented address.
|
|
- Under attended `platform-admin` OIDC, OpenBao accepted the updated policy.
|
|
A normalized readback matched the source file.
|
|
- The ops-warden audit used `policy_source: server` and reported 17 high-risk
|
|
lanes: 12 covered catalog entries, zero uncovered, and five with no concrete
|
|
KV address. The policy itself contains 12 unique deny paths because two
|
|
catalog entries share the Binky IMAP path and Core Hub is an additional
|
|
reviewed deny without a catalog lane.
|
|
|
|
## Attachment audit and residual blocker
|
|
|
|
A metadata-only scan listed and read role configuration under netkingdom OIDC,
|
|
Kubernetes auth, AppRole, and token roles. It found:
|
|
|
|
- roles attaching `agent-high-risk-boundary`: **0**;
|
|
- roles combining it with any `workload-kv-read-*` policy: **0**.
|
|
|
|
The live policy is therefore complete but is not automatically attached to a
|
|
coding-agent identity. The documented manual short-lived token example is not
|
|
a standing identity and carries no workload-read policy. Attaching the boundary
|
|
to `platform-admin` would incorrectly constrain the attended operator role and
|
|
erase the human/agent distinction, so that change was not made.
|
|
|
|
The remaining work is an identity-owner decision: define a distinct coding-
|
|
agent issuance path, attach the boundary, and prove that deny wins when a
|
|
workload read policy is also present. A versioned generated list of concrete
|
|
high-risk deny paths is also requested from ops-warden so policy coverage does
|
|
not depend on manual catalog transcription.
|