tegwick
4349758608
Declare Engine/PIP machine-readably, publish a total fail-closed PEP stance map, stop minting local decision ids on engine-unavailable DENY, bind allows to a 30s request lifetime, confine the local authorization double, classify evidence and emit a denial/revocation heartbeat, and prove access-control facts remain claims. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
# user-engine — PEP unreachable-engine stance map
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md §5
|
|
# Validate: tests/test_layer_conformance.py
|
|
#
|
|
# user-engine is a PEP-shaped Engine (PIP). Protected mutations proceed only
|
|
# with a decision from access-engine, or under this published stance whose
|
|
# application is recorded in place of a decision.
|
|
#
|
|
# Total by construction: every zone in security-zones_v0.1, plus unknown and
|
|
# not-applicable. No implicit default. Production is fail-closed everywhere,
|
|
# including unknown.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: user-engine
|
|
pep_shape: true
|
|
declared_by: INTENT.md
|
|
|
|
protected_action: "user-engine owned mutations (account, membership, registration, hat, catalog, profile)"
|
|
decision_engine: access-engine
|
|
scope: security-zone
|
|
|
|
stance:
|
|
z0-experimental: fail_closed
|
|
z1-operational: fail_closed
|
|
z2-protected: fail_closed
|
|
z2-continuity: fail_closed
|
|
z3-critical: fail_closed
|
|
unknown: fail_closed
|
|
not-applicable: fail_closed
|
|
|
|
allow_binding: request
|
|
allow_lifetime_seconds: 30
|
|
|
|
on_apply:
|
|
recorded_fields:
|
|
- stance_applied
|
|
- stance_scope
|
|
- outcome
|
|
- decision_id
|
|
decision_id: present only where access-engine rendered a decision
|
|
written_to:
|
|
- "local audit_records (UserEngineService._authorize)"
|
|
never_recorded: "caller tokens, secret material, profile payloads"
|
|
|
|
verdict_caching: none
|
|
|
|
reconstructability:
|
|
bound: "§9.6 — local audit and outbox prove the records they hold"
|
|
completeness_claimed: false
|