---
id: MKTT-WP-0009
type: workplan
title: "Access-Controlled Knowledge Gateway"
domain: markitect
status: done
owner: markitect-tool
topic_slug: markitect
planning_priority: complete
planning_order: 80
depends_on_workplans:
  - MKTT-WP-0006
created: "2026-05-03"
updated: "2026-05-03"
state_hub_workstream_id: "f36acbc9-881d-46f2-9181-67de228df0c2"
---

# MKTT-WP-0009: Access-Controlled Knowledge Gateway

## Purpose

Add a policy boundary for cached retrieval and context packages so Markitect can
support security-sensitive knowledge systems and agent workflows.

## Implementation Summary

Implemented as an internal policy-gateway extension, centered on
`LocalLabelPolicyGateway`:

- local labels, trust zones, and path rules
- enforce, audit, and off modes
- drop or redact behavior for denied results
- stable `PolicyDecision` ids and explainable decision envelopes
- denied/redacted result diagnostics
- policy-aware `mkt cache query` and `mkt search`
- `mkt policy check`
- relationship and rule policy adapter protocols for future
  Zanzibar/OpenFGA/SpiceDB, OPA/Rego, and Cedar integrations

Documentation: `docs/access-control-policy-gateway.md`.

Examples: `examples/policy/`.

## P9.1 - Define access-control ladder

```task
id: MKTT-WP-0009-T001
status: done
priority: high
state_hub_task_id: "acf240b4-7210-4ee5-90b6-2f2fe1438439"
```

Specify supported modes:

- labels and trust zones
- path/file ACLs
- relationship-based access control
- attribute/rule-based policies
- external policy engines

## P9.2 - Implement local label policy

```task
id: MKTT-WP-0009-T002
status: done
priority: high
state_hub_task_id: "9eb589d2-82f2-4282-9af0-3958826d397d"
```

Start with local policy labels and diagnostics for denied or redacted results.

## P9.3 - Add policy-aware query filtering

```task
id: MKTT-WP-0009-T003
status: done
priority: high
state_hub_task_id: "d78ab623-c472-4b24-ad84-08464b574886"
```

Ensure results are filtered before leaving the backend boundary. Result
metadata must report whether policy filtering occurred.

## P9.4 - Add relationship policy adapter design

```task
id: MKTT-WP-0009-T004
status: done
priority: medium
state_hub_task_id: "bd4c2b7a-6eac-4845-b5c8-9f9c64946f0c"
```

Design an adapter boundary for Zanzibar/OpenFGA/SpiceDB-style relationship
checks without binding the core package to any one service.

## P9.5 - Add rule policy adapter design

```task
id: MKTT-WP-0009-T005
status: done
priority: medium
state_hub_task_id: "752f1962-e83c-44cc-a1c1-0f89a4ea2a90"
```

Design an adapter boundary for OPA/Rego and Cedar-style rule policies.

## P9.6 - Add decision logs and explainability

```task
id: MKTT-WP-0009-T006
status: done
priority: medium
state_hub_task_id: "990f01fa-5008-4871-a887-1c6ab4375605"
```

Record policy decisions with subject, action, object, context, decision,
reason, and provenance.

## Exit Criteria

- Local caches can operate in an explicit policy mode.
- Query and context package results are policy-aware.
- More rigid authorization engines can attach later without replacing the
  query/cache framework.

## Notes

Context package filtering is represented through the same gateway and adapter
protocols, but persistent context package storage remains future WP-0008 scope.
Persistent decision-log storage is also intentionally deferred to backend work;
the local gateway explains decisions made by the current instance.