RAIFFABoundary and security

BOUNDARY · AUTHORITY NONE

LOCAL SIMULATION · TEST_ONLYLocal validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

Separate eligibility review from authority issuance.

What local evidence verifies, what a real authority path still requires, and which bypasses must stay closed.

01

Currently verified scope

  • Local opaque-reference and exact-binding validation
  • Missing conditions, mismatch, expiry, revocation, and replay failures
  • Append-only SQLite ledger and rebuildable projection
  • Credentialless Authority Console display fixture
  • Fail-closed policy gap in Sandbox authorization
02

Still required for a real authority path

  • Organization-owned Policy/Identity publisher
  • Verified IdP login and durable session
  • Operational actor, role, delegation, and scope mapping
  • Independently audited authority ledger and revocation propagation
  • Permitted execution adapter and outcome evidence
  • Operational key custody, incident response, and SLA
03

Bypasses that must remain closed

  • Treating a UI button as authority
  • Trusting caller pass or ready flags
  • Reusing an expired or revoked gate
  • Expanding actor or scope through wildcards
  • Executing from a PÓLYA DecisionCaseRef alone
  • Converting a TEST_ONLY fixture into a production credential