Authenticate Humans and Map Identity Across Three Planes

Enterprise problem: Reusing one role or token across platform administration, runtime operations, and generated-app data turns organization membership into unintended access to deployments and customer records.

Whole-course context: Workload and delegated connector grants are separate design records rather than implemented authorities; today establishes the provider identity baseline before collaboration and publication.

Today’s slice: Design three plane-local principal mappings and inspect the provider-plane JWT identity implemented today; hosted-runtime operator and generated-app user grants are not yet implemented.

End-of-day evidence: A five-minute provider token and tests for signature, issuer, audience, expiry, subject, and organization prove the implemented boundary; plane-local grants and independent revocation remain explicit missing evidence.

Still unsolved: Sharing invitations, publication approval, release promotion, AWS federation, and production incident roles remain later slices.

The customer outcome is a reviewable authenticate humans and map identity across three planes change, not a collection of requirements. This day starts with the implementation boundary, then uses the command or manifest below to produce positive, denied, and recovery evidence.

Provider identity service, hosted-runtime identity proxy, and generated-app session service; API workloads; provider and app identity databases plus audit object storage; session cache is permitted only as a short-lived derivative and cannot outlive revocation checks.

This map names the implementation boundary for this day. The service or controller changes only the state it owns; runtime and audit evidence let the operator distinguish a declared change from an effective one.

Prove independent revocation

Inspecting token claims cannot prove every API rejects the wrong audience. The current implementation has one provider audience, forge-control-plane, and derives its value when minting a short-lived local token; it cannot prove independent runtime or generated-app revocation. Read the exact development-token tool in scripts/mint-local-token.py.

claims = encode({"sub": os.getenv("ACTOR", "owner@acme.test"), "org": os.getenv("ORGANIZATION_ID", "acme"), "iss": "helixworks-forge", "aud": "forge-control-plane", "exp": int(time.time()) + 300})
signed = f"{header}.{claims}"
signature = base64.urlsafe_b64encode(hmac.new(secret.encode(), signed.encode(), hashlib.sha256).digest()).decode().rstrip("=")
print(f"{signed}.{signature}")

Share authentication only where it reduces login friction; never share authorization implicitly. Every cross-plane mapping is explicit, least-privilege, audited, and independently revocable, and every API validates issuer, audience, tenant, resource, and current grant state.