generated from coulomb/repo-seed
54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
# Workload Security Posture Charter
|
|
|
|
Date: 2026-06-27
|
|
Workplan: WARDEN-WP-0015
|
|
|
|
## Decision
|
|
|
|
ops-warden will steward the NetKingdom workload security posture model as an
|
|
author-and-conformance surface, not as runtime enforcement or secret custody. The
|
|
model has two orthogonal axes:
|
|
|
|
- environment posture: `dev`, `test`, `prod` secret-store posture;
|
|
- workload maturity: `M0` through `M3`, describing whether a workload may receive
|
|
increasingly sensitive secrets/data.
|
|
|
|
The axes combine in a secret-flow lattice. A real secret may flow only when the
|
|
workload is in prod posture, the workload maturity meets the secret's
|
|
`required_maturity`, and the maturity meets the floor implied by the secret's data
|
|
classification.
|
|
|
|
## Boundary
|
|
|
|
This expands ops-warden's stewardship role without expanding secret custody:
|
|
|
|
- OpenBao holds secret values.
|
|
- flex-auth makes allow/deny decisions and is the eventual runtime enforcement point
|
|
for the lattice.
|
|
- key-cape/Keycloak establish identity.
|
|
- CARING governs access semantics.
|
|
- ops-warden issues SSH certificates, routes/assists other credential lanes, and
|
|
checks conformance evidence.
|
|
|
|
`warden access` from WP-0014 remains valid under this model because it is a
|
|
transparent conduit: it runs the owning tool as the caller, does not hold a standing
|
|
credential, does not persist values, and records metadata-only audit evidence.
|
|
|
|
## Why it matters
|
|
|
|
The model turns vague IT-security blockers into named outcomes:
|
|
|
|
- dev/test work can proceed with synthetic contract doubles rather than waiting for
|
|
production secrets;
|
|
- production work with real values must name owner custody, policy gate, posture,
|
|
maturity, and non-secret evidence;
|
|
- maturity below a secret's requirement remains a real blocker until the workload or
|
|
design changes;
|
|
- operator ceremonies such as prod OpenBao unseal and issuer custody remain hard
|
|
gates and must not be bypassed with agent-visible secret values.
|
|
|
|
## Follow-up
|
|
|
|
WARDEN-WP-0015 continues with the read-only conformance checker, dev-tier contract
|
|
doubles, and coordinated canon landing in net-kingdom and info-tech-canon.
|