From 3a63da0edcc09bb9ccdc07d36e9a47995df2d192 Mon Sep 17 00:00:00 2001 From: Saurabh Jain Date: Wed, 9 Sep 2026 15:36:48 +0200 Subject: [PATCH] docs(authzen): commit to the end-user subject at v11, matching this file's own table The mapping table said the identity plane activates at v11; the prose 23 lines later said 'at v11 or later'. Same file, opposite epistemic status. Three of the five published SDKs already commit in every location, so the status quo was three customers planning for v11 and two told not to. This repository now carries the identical sentence the other three do. Also: the 'What has not been decided' list is down to one item, so its closing sentence no longer reads as a plural, and the new section states its own deletion condition because this repository has no v11 checklist to hold one. Signed-off-by: Saurabh Jain --- docs/AUTHZEN_MIGRATION_DRAFT.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/AUTHZEN_MIGRATION_DRAFT.md b/docs/AUTHZEN_MIGRATION_DRAFT.md index b2772e5..5b611da 100644 --- a/docs/AUTHZEN_MIGRATION_DRAFT.md +++ b/docs/AUTHZEN_MIGRATION_DRAFT.md @@ -53,9 +53,19 @@ Practically: port one call, run it, and read the pointers. The refusal names the 2. **A refusal is a different type from a denial.** `AuthZENRefusedException` versus a returned `AuthZENDecision` whose `isAllowed()` is false. Legacy callers that branched on a boolean will need one more `catch`. Callers that treated a transport failure as a denial were already wrong, and this makes it a distinct exception type rather than a production incident. +## Not yet expressible + +An **end-user subject**. `AuthZENSubject.type` must be `"gateway"` today, because an +end-user subject would have to be trusted from caller-supplied JSON - an +impersonation surface - or silently dropped, which is the fail-open this surface +exists to prevent. It arrives with the identity plane at v11. Integrations that +authorize per end user should stay on the legacy `userToken` path until then. + +Delete this section when the end-user subject ships, which is the same release +that removes the DRAFT marker below. + ## What has not been decided -- Whether an end-user subject becomes available at v11 or later, and what the identity plane requires of a caller to bind one. - Whether `resource.id` for an `llm` target widens to name a provider and model, which depends on the evaluator learning to read them. -None of these should be planned around until this file loses its DRAFT marker. +This should not be planned around until this file loses its DRAFT marker.