[P0-20] Enforce capability, tenant, dataset, actor, and target authorization #28

New issue

Closed

opened 2026-07-22 00:13:23 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-22 00:13:23 +00:00

(Migrated from github.com)

Problem

Authentication alone is insufficient. Current routes directly read, create, search, dispatch, update, and delete data without a policy decision.

Required changes

Define a policy protocol receiving principal, action, resource, dataset/tenant, actor/target, request metadata, and current quotas.
Deny by default.
Enforce capabilities at every HTTP endpoint and internal service boundary, not only in route wrappers.
Scope document reads/searches/writes/deletes to allowed datasets and tenants.
Scope target dispatch and leases to allowed actors, target namespaces, and programs.
Require elevated capability for force-release, credential administration, replay, and destructive operations.
Propagate authorization context through Rabbit envelopes without trusting caller-supplied principal fields.
Emit structured allow/deny audit events with redaction.

Acceptance tests

A read-only principal cannot write, delete, dispatch, or lease.
Dataset-scoped credentials cannot access another dataset through direct id lookup, search, views, bulk, or target routes.
Internal library callers must provide an explicit principal or a deliberately configured trusted context.
Force-release and admin endpoints reject ordinary target operators.
Policy denial is consistent across HTTP and embedded-library calls.

## Problem Authentication alone is insufficient. Current routes directly read, create, search, dispatch, update, and delete data without a policy decision. ## Required changes - Define a policy protocol receiving principal, action, resource, dataset/tenant, actor/target, request metadata, and current quotas. - Deny by default. - Enforce capabilities at every HTTP endpoint and internal service boundary, not only in route wrappers. - Scope document reads/searches/writes/deletes to allowed datasets and tenants. - Scope target dispatch and leases to allowed actors, target namespaces, and programs. - Require elevated capability for force-release, credential administration, replay, and destructive operations. - Propagate authorization context through Rabbit envelopes without trusting caller-supplied principal fields. - Emit structured allow/deny audit events with redaction. ## Acceptance tests - A read-only principal cannot write, delete, dispatch, or lease. - Dataset-scoped credentials cannot access another dataset through direct id lookup, search, views, bulk, or target routes. - Internal library callers must provide an explicit principal or a deliberately configured trusted context. - Force-release and admin endpoints reject ordinary target operators. - Policy denial is consistent across HTTP and embedded-library calls.