info-tech-canon/workplans/ITC-WP-0010-caring-kubernetes-rbac-benchmark.md

id, type, title, domain, repo, status, priority, created, updated, depends_on_workplans, state_hub_workstream_id

id	type	title	domain	repo	status	priority	created	updated	depends_on_workplans	state_hub_workstream_id
ITC-WP-0010	workplan	CARING Kubernetes RBAC Benchmark	canon	info-tech-canon	proposed	medium	2026-05-23	2026-05-23	ITC-WP-0003 ITC-WP-0005	b64f0fc9-8668-4c02-8247-67a41660bdeb

ITC-WP-0010 - CARING Kubernetes RBAC Benchmark

Goal

Create a distinct benchmark workplan for analyzing Kubernetes RBAC through CARING and the wider InfoTechCanon kernel.

Intent

This is deliberately separate from the small SaaS proof. The benchmark is more ambitious and should stress orthogonality across Access Control, Organization, Governance, Security, Network, DevSecOps, Observability, Task, and Tagging.

Tasks

T01 - Benchmark workspace

id: ITC-WP-0010-T01
status: todo
priority: high
state_hub_task_id: "9ad31e13-7dc2-469c-b539-d3375a16c5f4"

• Create infospace/standards/caring/benchmarks/kubernetes-rbac/.
• Define source corpus, cases, expected outputs, and review criteria.

T02 - RBAC assimilation

id: ITC-WP-0010-T02
status: todo
priority: high
state_hub_task_id: "180d7ccf-7daa-4f4c-a92a-641ef5d7b442"

• Map Kubernetes Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount, Namespace, verbs, resources, and scopes.
• Preserve the warning that Namespace is not automatically a tenant boundary.

T03 - CARING access descriptors

id: ITC-WP-0010-T03
status: todo
priority: high
state_hub_task_id: "4ffd6643-a7ab-487c-a09a-0fcaf0115c83"

• Express benchmark cases as CARING access descriptors.
• Distinguish declared access, effective access, derived capability, and induced access.

T04 - Findings and canon pressure

id: ITC-WP-0010-T04
status: todo
priority: medium
state_hub_task_id: "52632a4c-6e03-4212-ad6b-0cbb7b3a6e42"

• Produce gaps, conflicts, mappings, and proposed canon changes.
• Feed stable findings back into models and standards through explicit tasks.

Acceptance

• Kubernetes RBAC is analyzed as a benchmark, not as a shortcut profile.
• CARING descriptor shape is tested with practical examples.
• Benchmark findings produce explicit canon change proposals.