Define delegation and acting-in-place lifecycle rules #3

New Issue

2026-07-10T11:01:18+02:00

zemion commented

2026-07-10 11:01:18 +02:00

Turn the delegation and acting-in-place concept into enforceable module behavior.

Acceptance criteria:

Function delegation, substitution, and acting-in-place modes are documented with examples.
Validation covers who may delegate, when delegation expires, and how revocation is audited.
Access receives enough context to distinguish own function, delegated function, and acting-for-someone function.
Tests cover active, expired, revoked, and unauthorized delegation states.

Turn the delegation and acting-in-place concept into enforceable module behavior. Acceptance criteria: - Function delegation, substitution, and acting-in-place modes are documented with examples. - Validation covers who may delegate, when delegation expires, and how revocation is audited. - Access receives enough context to distinguish own function, delegated function, and acting-for-someone function. - Tests cover active, expired, revoked, and unauthorized delegation states.

zemion commented

2026-07-11 00:56:33 +02:00

Codex State: progress

Summary

Organizations stores function-level delegable and acting-in-place flags; IDM assignment writes validate delegated and acting-for source semantics.
Access explanation/principal contracts carry function assignment, delegation, and acting-for provenance fields.

Verification

unittest tests.test_idm_api: delegated assignment validation covered

Next / Blocked

Still open: explicit runtime acting-in-place selector, expired/revoked/unauthorized lifecycle tests, and final audit/revocation behavior.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Organizations stores function-level delegable and acting-in-place flags; IDM assignment writes validate delegated and acting-for source semantics. - Access explanation/principal contracts carry function assignment, delegation, and acting-for provenance fields. ### Verification - `unittest tests.test_idm_api: delegated assignment validation covered` ### Next / Blocked - Still open: explicit runtime acting-in-place selector, expired/revoked/unauthorized lifecycle tests, and final audit/revocation behavior. Suggested status label: `status/in-progress`

zemion added the area/governance area/rbac codex/ready module/organizations

labels 2026-07-29 14:15:10 +02:00

zemion commented

2026-07-31 15:06:34 +02:00

Function request/grant journeys are now tracked in GovOPlaN/govoplan-idm#8/#9. This issue should supply the delegation/acting lifecycle constraints consumed by their effective grant policy; Organizations owns function definitions while IDM owns the request/grant and assignment records.

zemion commented

2026-08-19 22:17:12 +02:00

Completed and published across the owning boundaries.

Organizations d1e3b1c documents the distinct delegable/substitution and act-in-place semantics on function definitions.
IDM dc99a40 documents concrete direct, delegated, and acting-for examples, authority/governance prerequisites, validity/expiry, revocation, audit events, and fail-closed effective resolution. It also adds explicit tests that functions forbidding delegation or representation reject those assignments.
Access 38fc22c updates the static/administrator documentation for the already implemented interactive acting-context endpoints, exact-session selection, real/represented account provenance, auditing, and stale/mismatched fail-closed behavior.

The runtime acceptance behavior is covered by IDM effective-directory tests for active, future, expired, inactive/revoked, cross-tenant, and wrong-function sources; IDM lifecycle-event tests for revoke/expire; and Access principal tests requiring an exact valid session selection.

Verification: IDM full suite 33 tests; Access focused interface/auth tests 8; Organizations documentation contract 2; changed-file Ruff; manifest registry 68/68; and the full focused workspace gate (57 WebUI permutations, 7 browser conformance tests) passed in the same integration state.

Completed and published across the owning boundaries. - Organizations `d1e3b1c` documents the distinct delegable/substitution and act-in-place semantics on function definitions. - IDM `dc99a40` documents concrete direct, delegated, and acting-for examples, authority/governance prerequisites, validity/expiry, revocation, audit events, and fail-closed effective resolution. It also adds explicit tests that functions forbidding delegation or representation reject those assignments. - Access `38fc22c` updates the static/administrator documentation for the already implemented interactive acting-context endpoints, exact-session selection, real/represented account provenance, auditing, and stale/mismatched fail-closed behavior. The runtime acceptance behavior is covered by IDM effective-directory tests for active, future, expired, inactive/revoked, cross-tenant, and wrong-function sources; IDM lifecycle-event tests for revoke/expire; and Access principal tests requiring an exact valid session selection. Verification: IDM full suite 33 tests; Access focused interface/auth tests 8; Organizations documentation contract 2; changed-file Ruff; manifest registry 68/68; and the full focused workspace gate (57 WebUI permutations, 7 browser conformance tests) passed in the same integration state.

zemion closed this issue

2026-08-19 22:17:12 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-organizations#3