coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement USER-WP-0024 security layer conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details

Browse source 
Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
This commit is contained in:
tegwick 2026-08-29 12:53:16 +02:00
parent c7b6148a70
commit 4349758608
22 changed files with 1242 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/hats-realms-services-assets-access-profiles.md
View file

@ -87,8 +87,14 @@ contexts are omitted from projections for other applications.
## Export Boundary
`export_access_control_facts` returns an adapter-neutral manifest plus facts.
External authorization engines or ACL systems can consume these facts, but
they remain responsible for final policy decisions and runtime enforcement.
Hats, access profiles, and `AccessControlFact` values are PIP **claims**.
They are not an authorization decision. Compiling them into a local
allow or deny before `access-engine` runs is an early decision
(security-layer-model §6.1) and is forbidden.
`select_active_hat` and `export_access_control_facts` never return an
effect. `access-engine` remains the only decision point; consumers that
need an allow or deny must ask it.
## Redaction And Diagnostics