João Salavisa
481359ddb2
Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
61 lines
1.9 KiB
Markdown
61 lines
1.9 KiB
Markdown
---
|
|
status: draft
|
|
system: auth
|
|
specification_version: 1
|
|
migration: in_progress
|
|
owners:
|
|
- kandev
|
|
---
|
|
|
|
# Authorization and identity system
|
|
|
|
## Purpose
|
|
|
|
The authorization and identity system owns authentication state, trust
|
|
boundaries, session credentials, and authorization checks shared by Kandev
|
|
surfaces.
|
|
|
|
## Ownership
|
|
|
|
This system owns authenticated identity, trusted proxy handling, session and
|
|
cookie boundaries, self-action guards, share-link access, and security checks
|
|
for user and service requests.
|
|
|
|
## Exclusions
|
|
|
|
- Provider credentials and external service connections belong to the
|
|
[integration system](../integrations/README.md).
|
|
- Agent permission policy belongs to the [agent system](../agents/README.md).
|
|
|
|
## Specification map
|
|
|
|
### Requirements
|
|
|
|
|
|
|
|
- [Opt-in Authentication & Multi-User Segregation](requirements/auth.md)
|
|
- [Org Roles and Scopes](requirements/roles-and-scopes.md)
|
|
- [Isolate Kandev cookies between instances on one host](requirements/fix-multi-instance-cookie-isolation.md)
|
|
- [Public Share Links (v0)](requirements/public-share-links.md)
|
|
- [Repair secure-context browser fallbacks](requirements/secure-context-browser-fallbacks.md)
|
|
- [Self-Actions Guard in System Users](requirements/self-actions-guard.md)
|
|
- [Session IP Refresh](requirements/session-ip-refresh.md)
|
|
- [Trusted Proxies for X-Forwarded-For](requirements/trusted-proxies.md)
|
|
|
|
### System design
|
|
|
|
|
|
|
|
- [Isolate Kandev cookies between instances on one host](system-design/fix-multi-instance-cookie-isolation.md)
|
|
- [Public Share Links (v0)](system-design/public-share-links.md)
|
|
|
|
## Migration record
|
|
|
|
Migration remains in progress while legacy source detail is extracted from the
|
|
canonical requirement and system-design documents above.
|
|
|
|
## Related systems
|
|
|
|
- [Integrations](../integrations/README.md): owns external provider auth.
|
|
- [Platform](../platform/README.md): owns process-level security boundaries.
|