coulomb/zone-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Headless multi-application, multi-tenant security zone mangement engine.
5 commits 1 branch 0 tags 565 KiB
Find a file
tegwick 9de50d3a48 ZONE-WP-0001: flex-auth amendments as the consuming PDP 
Reviewed as the only policy decision point. Four task amendments:

T01 - the 'only PDP' invariant guards latency, not authority. Compiled
data that determines an outcome still decides. Tightened wording:
zone-engine owns membership, flex-auth policy owns stance.

T03 - split membership from stance rather than rejecting option (c)
wholesale. Stance for the pre-sign gate belongs in the policy package
because registry content is absent from decision provenance. Also:
fail-open is a PEP property and no PDP can express it.

T05 - no registry schema change needed; metadata/attributes already
flatten into rego input. But trust_zone is a live name collision -
a hardcoded 'platform' constant no policy reads.

T04 - flex-auth loads registry and policy once at process start with
no reload path, so an inert compiled exception expires only by human
redeploy. Enforced expiry requires a not_after evaluated in rego.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 21:59:47 +02:00
workplans ZONE-WP-0001: flex-auth amendments as the consuming PDP 2026-08-19 21:59:47 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-19 21:19:35 +02:00
.gitignore chore: track scaffold gitignore and custodian brief 2026-08-19 21:20:12 +02:00
.repo-classification.yaml Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
AGENTS.md Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
GOAL.md Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
README.md Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
SCOPE.md Seed zone-engine — authority for security zones and exception lifecycle 2026-08-19 21:18:44 +02:00
WORK-RECORDS.md chore: track scaffold gitignore and custodian brief 2026-08-19 21:20:12 +02:00

README.md

zone-engine

Headless authority for security zones — named bands of the estate with different enforcement rigidity, and the lifecycle of time-boxed exceptions to them.

A zone answers a question no existing axis answers: is this control enforced here, and what happens when it fails? NetKingdom can already say how exposed a workload is (environment posture), how ready it is (workload maturity M0–M3), and what state the organization is in (organization_posture). All three describe. None decides.

zone-engine is not a policy decision point. flex-auth remains the only PDP; zone membership reaches it by compilation into the registry it already consumes, never by a synchronous lookup in the decision path.

Orient: GOAL.md → SCOPE.md → workplans/.