# Portal boundary and threat model

The portal is a transport adapter for user-engine, not a new identity
authority. KeyCape owns login, credentials, MFA, authentication sessions and
OIDC tokens. flex-auth owns authorization decisions. user-engine owns users,
tenant memberships, profiles, registration, invitations, onboarding, audit
records and lifecycle intent. NetKingdom implements `IdentityProvisioningPort`
without leaking provider clients into the domain.

## Trust boundaries

- The public edge terminates TLS, rate-limits login/registration and validates
  OIDC tokens. It strips all inbound `X-Verified-*` and
  `X-User-Engine-Proxy-Secret` headers before injecting verified claims and
  the runtime-only proxy marker.
- user-engine rejects every protected route if that marker or verified claims
  are absent. Direct pod traffic is blocked by NetworkPolicy.
- Browser state is navigation state only. It is never authoritative for roles,
  tenants, registration progress or lifecycle status.
- Provider credentials come from approved runtime secret references. They do
  not enter requests, logs, audit payloads, workplans or Git.

## Controls

Protected writes receive a flex-auth decision through the existing
`AuthorizationCheckPort`. Tenant context is re-resolved in the service, so a
tenant administrator cannot select another tenant. Mutations carry request
correlation IDs and emit redacted audit/outbox records. Provisioning requests
carry independent idempotency keys and support safe resume after ambiguity.

The application emits a restrictive content security policy, prevents
framing and MIME sniffing, disables sensitive response caching and escapes
all server-rendered values. State-changing browser forms must use same-site
cookies plus edge-issued CSRF tokens; the initial JSON API is intended for
bearer-authenticated same-origin clients. Invitation tokens are single-use,
hashed at rest, time-bound and rate-limited at both identity and address
dimensions. Public errors must not reveal whether an email or tenant exists.

Audit retention, identity erasure and external deprovisioning are distinct
operations. Audit identifiers remain pseudonymous after erasure. Provider
outage leaves a retryable outbox item and never reports the lifecycle change
as externally complete. Compensation is idempotent and operator-visible.

## Deferred

Enterprise SAML/OIDC federation, SCIM and corporate directory synchronization
remain provider adapters. Their external ownership metadata and identity links
must fit the existing neutral boundaries rather than becoming user-engine
domain dependencies. The published target is IAM Profile v0.3 Keycloak
expanded mode
(`https://policy.coulomb.social/standards/iam-profile/v0.3/`); a dedicated
workplan is created only when a tenant demands those integrations.