tegwick
8d525d959e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
75 lines
3 KiB
Markdown
75 lines
3 KiB
Markdown
---
|
|
id: USER-WP-0033
|
|
type: workplan
|
|
title: "P06 scoped authentication policy and safe optional onboarding"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: communication
|
|
created: "2026-09-13"
|
|
updated: "2026-09-14"
|
|
state_hub_workstream_id: "d49778a4-faca-5712-8db3-1d15a7989aee"
|
|
---
|
|
|
|
Implements P06 under USER-WP-0030-T03 and KEY-WP-0035. Authorized by the
|
|
user's P06 request and prior optional-OTP requirement. Existing MFA enforcement
|
|
for unrelated clients remains in its current configuration.
|
|
|
|
## Protect privileged actions independently of ordinary account login
|
|
|
|
```task
|
|
id: USER-WP-0033-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "193b737c-f9a0-5d30-8e70-efe7550df258"
|
|
```
|
|
|
|
AAL1 users can reach account/onboarding and authenticator setup. Administrative
|
|
browser/API operations require MFA. Policy changes and factor recovery require
|
|
recent MFA. Explain step-up, unavailable setup and identity-switch recovery.
|
|
|
|
## Provide scoped policy preview, confirmed apply, audit and rollback
|
|
|
|
```task
|
|
id: USER-WP-0033-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "4e635786-6a68-54a1-b1a1-b73c14fd417f"
|
|
```
|
|
|
|
Issuer-owned persistent policy state for the two reviewed browser clients only.
|
|
Support mandatory and optional-after-enrollment; explicit application AAL2
|
|
always wins. Reject ambiguous or unsupported weakening, stale confirmation,
|
|
wrong role/audience and replay with altered intent. Durable receipts and guarded
|
|
rollback survive issuer replacement. Portal carries verified identity, no admin
|
|
credential. Changes affect subsequent authorization, not already issued tokens.
|
|
|
|
## Verify onboarding and publish the scoped release
|
|
|
|
```task
|
|
id: USER-WP-0033-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "006b3246-4f54-5989-9126-5ac0b95e226d"
|
|
```
|
|
|
|
Test no-factor/password-only, pending/cancel/confirmed enrollment, enrolled OTP,
|
|
old AAL1 sessions, mandatory/explicit AAL2, provider outage/recovery, privileged
|
|
portal denial and policy preview/apply/replay/rollback. Use actual installed
|
|
provider in isolated fixtures, browser tests and native non-mutating readback.
|
|
Enable only vergabe-demo-company and user-engine-portal optional policies after
|
|
privileged guards pass. Record canonical deployment and rollback evidence.
|
|
|
|
Resumed after interruption: portal browser 30/30, policy tests 5/5, issuer policy
|
|
regressions and rollout tests pass. Installed-provider acceptance Job
|
|
`provider-p06-browser-46713f7e` passed native optional/old-session OTP plus five
|
|
browser checks. Fixed test endpoint and asynchronous TOTP/detail readiness.
|
|
Release and live readback remain in progress. See P06 evidence.
|
|
|
|
2026-09-14: P06 completed with CI-published portal and issuer images, provider
|
|
guard and scoped client migration. Both services are ready; persistent policy
|
|
readback confirms the two optional-after-enrollment clients. Evidence:
|
|
`docs/evidence/2026-09-13-p06-authentication-policy.md`. Residual customer sign-in,
|
|
user onboarding and workload propagation remain live in USER-WP-0028,
|
|
KEY-WP-0034 and VERGABE-WP-0019; this does not close those workplans.
|