Carlos Florênciostatus, system, specification_version, migration, owners
| status | system | specification_version | migration | owners | |
|---|---|---|---|---|---|
| draft | auth | 1 | in_progress |
|
Authorization and identity system
Purpose
The authorization and identity system owns authentication state, trust boundaries, session credentials, and authorization checks shared by Kandev surfaces.
Ownership
This system owns authenticated identity, trusted proxy handling, session and cookie boundaries, self-action guards, share-link access, and security checks for user and service requests.
Exclusions
- Provider credentials and external service connections belong to the integration system.
- Agent permission policy belongs to the agent system.
Specification map
Requirements
- Opt-in Authentication & Multi-User Segregation
- Isolate Kandev cookies between instances on one host
- Public Share Links (v0)
- Repair secure-context browser fallbacks
- Self-Actions Guard in System Users
- Session IP Refresh
- Trusted Proxies for X-Forwarded-For
System design
Migration record
Migration remains in progress while legacy source detail is extracted from the canonical requirement and system-design documents above.
Related systems
- Integrations: owns external provider auth.
- Platform: owns process-level security boundaries.