coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/docs/mfa-pilot-decision.md
tegwick 2edb4f1e43
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Record MFA pilot decision: coulomb-social, optional, NetKingdom-held 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 445231@bnt-lap001
Assistant-Session: 024a807e-0cc5-4f2c-bc8a-b83322d1395d
2026-10-09 11:58:45 +02:00

2.1 KiB
Raw Blame History

MFA pilot: coulomb-social, optional, NetKingdom-held — 2026-10-09

Founder decision (Bernd, 2026-10-09). It answers the pilot and policy part of NK-WP-0042-T02 (hub thread 892fd489). It does not resolve decision cef97ccd: user-perspective acceptance of the MFA journey still needs the attended run (USER-WP-0027-T04, USER-WP-0028-T03).

Decision

  1. Pilot workload: coulomb-social.
  2. MFA code stays in NetKingdom infrastructure. Enrollment, verification, replacement, recovery, and the policy that requires MFA live with the issuer (KeyCape / Keycloak, the provider factor) and user-engine (/security, the provider-management handoff, P04 recovery, P06 policy). coulomb-social does not gain factor, enrollment, recovery, or MFA policy code. It stays a plain OIDC relying party.
  3. MFA is optional for coulomb-social users. Password-only sign-in stays valid (U05). Users may enroll voluntarily through the NetKingdom path (U06). Once a user has enrolled, the issuer enforces their factor (U07).
  4. Admin-required MFA is deferred, not urgent. When a coulomb-social admin later wants MFA required for users, it will be an issuer-side client policy applied through the NetKingdom admin surface (P06 preview/apply/rollback). It will not be a coulomb-social code path. Turning it on is a separate change that needs the founder's go.

Consequences

  • No acr_values=aal2 switch-on for coulomb-social now. Under optional MFA, coulomb-social requests no assurance level.
  • coulomb-social already contains a dormant relying-party hook (?assurance=aal2 → acr_values, plus a local acr check in apps/identity/views.py). Nothing links to it. Whether to keep it dormant or remove it is coulomb-social's call. The issuer-side policy route in (4) does not need it.
  • coulomb-social may link users to the NetKingdom /security page for optional enrollment and recovery help. That link is navigation, not MFA logic.
  • This narrows the SCOPE line "action step-up — consuming apps": for this pilot, step-up sits with KeyCape client policy.