Skip to content

docs(authzen): commit to the end-user subject at v11, matching this file's own table #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saurabhjain1592 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(authzen): commit to the end-user subject at v11, matching this file's own table #233

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions docs/AUTHZEN_MIGRATION_DRAFT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,19 @@ Practically: port one call, run it, and read the pointers. The refusal names the

2. **A refusal is a different type from a denial.** `AuthZENRefusedException` versus a returned `AuthZENDecision` whose `isAllowed()` is false. Legacy callers that branched on a boolean will need one more `catch`. Callers that treated a transport failure as a denial were already wrong, and this makes it a distinct exception type rather than a production incident.

## Not yet expressible

An **end-user subject**. `AuthZENSubject.type` must be `"gateway"` today, because an
end-user subject would have to be trusted from caller-supplied JSON - an
impersonation surface - or silently dropped, which is the fail-open this surface
exists to prevent. It arrives with the identity plane at v11. Integrations that
authorize per end user should stay on the legacy `userToken` path until then.

Delete this section when the end-user subject ships, which is the same release
that removes the DRAFT marker below.

## What has not been decided

- Whether an end-user subject becomes available at v11 or later, and what the identity plane requires of a caller to bind one.
- Whether `resource.id` for an `llm` target widens to name a provider and model, which depends on the evaluator learning to read them.

None of these should be planned around until this file loses its DRAFT marker.
This should not be planned around until this file loses its DRAFT marker.
Loading