Carlos Florêncio
1.9 KiB
1.9 KiB
status, system, specification_version, migration, owners
| status | system | specification_version | migration | owners | |
|---|---|---|---|---|---|
| draft | auth | 1 | complete |
|
Authorization and identity system
Purpose
The authorization and identity system owns authentication state, trust boundaries, session credentials, and authorization checks shared by Kandev surfaces.
Ownership
This system owns authenticated identity, trusted proxy handling, session and cookie boundaries, self-action guards, share-link access, and security checks for user and service requests.
Exclusions
- Provider credentials and external service connections belong to the integration system.
- Agent permission policy belongs to the agent system.
Specification map
Requirements
- Opt-in Authentication & Multi-User Segregation
- Isolate Kandev cookies between instances on one host
- Public Share Links (v0)
- Repair secure-context browser fallbacks
- Self-Actions Guard in System Users
- Session IP Refresh
- Trusted Proxies for X-Forwarded-For
System design
Migration record
All legacy sources assigned to this system are now represented by the canonical requirement and system-design documents above. Source detail is retained in those documents or in their linked design parts.
Related systems
- Integrations: owns external provider auth.
- Platform: owns process-level security boundaries.