Controlled disclosure was deferred to production on the reasoning that build
mode has no users to expose. The first finding to arrive is a live
authorization bypass in the service every other service trusts, where the
choice today is publish or hold with nothing between. The deferral may still be
right; it is now a decision with a real case in hand.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
First finding, and it establishes the record format by being one. Kept minimal
on purpose - inventing a schema before there is a second finding to test it
against would be designing in the dark.
The substance: POST /v1/check and /v1/batch_check authenticate no caller, so
any workload with network reach can assert any subject and any tenant and
receive an authoritative allow from the estate's authorization oracle.
Self-reported by flex-auth during their Tenancy Posture review, and their own
note says they did not know they were carrying it.
Severity, disclosure and escalation are left unset. Per INTENT this repo owns
those and the reporter does not, and filling them in as the routing party would
collapse the separation on the first record.
Two things stated rather than assumed. Exposure depends on whether a
default-deny NetworkPolicy fronts the service; flex-auth did not say, and I did
not check, because that would be reporting on a system I do not own. And the
disclosure question is genuinely live here - build mode is public-by-default,
this is a live authorization bypass, and the controlled-disclosure mechanism
this repo anticipates does not exist yet, so the choice today is publish or
hold with nothing in between.
Three related defects from the same review round are recorded as visible but
not filed, since filing them was not asked for. All four were found by repos
reading their own code against a ladder within a day of each other, and none
was found by monitoring - which is itself a fact worth carrying into triage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Owned by the-custodian alongside policy-nexus, with the duty of deciding what
must reach the operator personally.
Three things had nowhere to live. Findings landed in whichever document
discovered them - the estate's largest known gap is currently open question 3
in an unratified draft, with no owner, severity or date. Disclosure had no
mechanism, only publish-now or forget, which is fine in build mode and wrong at
production. And regulation was researched at the moment it was needed and never
retained.
Regulatory intake moves here from policy-nexus T06: deciding what a rule
demands of us is a judgement about risk, not an act of publishing. That also
leaves policy-nexus doing one thing, which was the point.
Two constraints written in deliberately. This repo does not fix - findings
route to the repo owning the defect, because a risk service that fixes becomes
a second engineering team with no boundary. And it does not block delivery in
build mode; if that changes it will be a decision recorded here, not a habit
that accretes.
The escalation rule is named as unwritten rather than invented. Getting it
wrong in either direction fails: escalate everything and the operator becomes
the queue, escalate nothing and the register is where serious things go quiet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
