markitect-tool/workplans/MKTT-WP-0009-access-controlled-knowledge-gateway.md

id, type, title, domain, status, owner, topic_slug, planning_priority, planning_order, depends_on_workplans, created, updated, state_hub_workstream_id

id	type	title	domain	status	owner	topic_slug	planning_priority	planning_order	depends_on_workplans	created	updated	state_hub_workstream_id
MKTT-WP-0009	workplan	Access-Controlled Knowledge Gateway	markitect	done	markitect-tool	markitect	complete	80	MKTT-WP-0006	2026-05-03	2026-05-03	f36acbc9-881d-46f2-9181-67de228df0c2

MKTT-WP-0009: Access-Controlled Knowledge Gateway

Purpose

Add a policy boundary for cached retrieval and context packages so Markitect can support security-sensitive knowledge systems and agent workflows.

Implementation Summary

Implemented as an internal policy-gateway extension, centered on LocalLabelPolicyGateway:

• local labels, trust zones, and path rules
• enforce, audit, and off modes
• drop or redact behavior for denied results
• stable PolicyDecision ids and explainable decision envelopes
• denied/redacted result diagnostics
• policy-aware mkt cache query and mkt search
• mkt policy check
• relationship and rule policy adapter protocols for future Zanzibar/OpenFGA/SpiceDB, OPA/Rego, and Cedar integrations

Documentation: docs/access-control-policy-gateway.md.

Examples: examples/policy/.

P9.1 - Define access-control ladder

id: MKTT-WP-0009-T001
status: done
priority: high
state_hub_task_id: "acf240b4-7210-4ee5-90b6-2f2fe1438439"

Specify supported modes:

• labels and trust zones
• path/file ACLs
• relationship-based access control
• attribute/rule-based policies
• external policy engines

P9.2 - Implement local label policy

id: MKTT-WP-0009-T002
status: done
priority: high
state_hub_task_id: "9eb589d2-82f2-4282-9af0-3958826d397d"

Start with local policy labels and diagnostics for denied or redacted results.

P9.3 - Add policy-aware query filtering

id: MKTT-WP-0009-T003
status: done
priority: high
state_hub_task_id: "d78ab623-c472-4b24-ad84-08464b574886"

Ensure results are filtered before leaving the backend boundary. Result metadata must report whether policy filtering occurred.

P9.4 - Add relationship policy adapter design

id: MKTT-WP-0009-T004
status: done
priority: medium
state_hub_task_id: "bd4c2b7a-6eac-4845-b5c8-9f9c64946f0c"

Design an adapter boundary for Zanzibar/OpenFGA/SpiceDB-style relationship checks without binding the core package to any one service.

P9.5 - Add rule policy adapter design

id: MKTT-WP-0009-T005
status: done
priority: medium
state_hub_task_id: "752f1962-e83c-44cc-a1c1-0f89a4ea2a90"

Design an adapter boundary for OPA/Rego and Cedar-style rule policies.

P9.6 - Add decision logs and explainability

id: MKTT-WP-0009-T006
status: done
priority: medium
state_hub_task_id: "990f01fa-5008-4871-a887-1c6ab4375605"

Record policy decisions with subject, action, object, context, decision, reason, and provenance.

Exit Criteria

• Local caches can operate in an explicit policy mode.
• Query and context package results are policy-aware.
• More rigid authorization engines can attach later without replacing the query/cache framework.

Notes

Context package filtering is represented through the same gateway and adapter protocols, but persistent context package storage remains future WP-0008 scope. Persistent decision-log storage is also intentionally deferred to backend work; the local gateway explains decisions made by the current instance.