From f111dcf5571b76644ce914df2ce62d48ff7bdbca Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:13:18 +0200 Subject: [PATCH 01/13] docs: specify IAM substrate over dir_sim and #1509 SAG --- .claude/plans/iam-substrate-sag-dir-sim-v1.md | 170 ++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 .claude/plans/iam-substrate-sag-dir-sim-v1.md diff --git a/.claude/plans/iam-substrate-sag-dir-sim-v1.md b/.claude/plans/iam-substrate-sag-dir-sim-v1.md new file mode 100644 index 000000000..c269b9c53 --- /dev/null +++ b/.claude/plans/iam-substrate-sag-dir-sim-v1.md @@ -0,0 +1,170 @@ +# D-IAM-SAG-0 — IAM substrate: dir_sim × OGAR × Class/Methods × Software Awareness Graph + +> **RFC / implementation handoff, documentation only.** Based on merged [#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509), merge commit `42fa2a347cda22eaaa327bba514f2029cc9daa82`. The goal is to specify executable, falsifiable IAM projections, not announce six shipped IAM products. No connector writes, security-authority migration, new opcode, second graph engine, or CE64 byte-semantic change is authorized. +> +> **Companions:** [Software Awareness Graph](software-awareness-graph-v1.md), [Class × Schema × Methods HotPlug](class-method-schema-hotplug-v1.md), [class/method falsifiers](class-method-hotplug-falsifiers-v1.md), [dir-sim persistence](dir-sim-persist-v1.md), [RBAC nested scope](../board/entries/2026-10-08-rbac-nested-scope-path.md), [research excerpts](../../.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md), [implementation prompt](../prompts/iam-substrate-after-1509.md). OGAR semantic sibling [#357](https://github.com/AdaWorldAPI/OGAR/pull/357) is an RFC, not a shipped dynamic-method link. + +## 0. Question and answer boundary + +Could the six functional domains in a typical IAM stack be *typed views* over one provenance-aware identity/entitlement substrate, using existing OGAR/dir_sim/Quack/SoftwareGraph infrastructure rather than reproducing SailPoint, CyberArk, Okta or Intune? + +**Candidate answer:** yes for read-only explanation, simulation and proposal *when the relevant graph edges and source-authority semantics are available*. No for live enforcement, SSO, session control, device management and privileged vault features without independent real provider APIs and permission gates. A syntactic class method is not an authorizing identity provider. + +Three distinct questions must survive every projection: +1. **Observed:** what did a version-pinned source actually return? Preserve source, source object identity, effective time, observation time, schema version and completeness. +2. **Inferred:** what follows from membership, role, device, resource and policy relationships? Preserve complete witness sets or explicitly label a *single* witness, assumptions, rule version and uncertainty. +3. **Authorized:** which action may a particular actor request or execute *now*, against which authority and version? Re-evaluate outside the analytical graph; mere high confidence never confers permission. + +## 1. First-hand inventory and exclusions (as of #1509) + +| Surface | Code-grounded behavior [G] | Remaining boundary [P]/[ABSENT] | +|---|---|---| +| `crates/lance-graph-dir-sim/src/lib.rs` | Separate users/groups SoA populations, GUID identities, Dn128 location, sparse membership, pure rules, validation, readonly LDAP bytes | Not an AD/Entra/PowerShell writer; no live authentication/authorization product | +| `dir-sim/src/store.rs`, `view.rs` | `VersionStore` observe/simulate/diff/plan; shared snapshot + delta-sized overlay; versioned provenance and refusal | Cross-policy/source coherent IAM snapshot and schema bridge must be designed | +| `dir-sim/src/actors.rs` | `GroupRoles::from_policy`, `role_evidence` and `RoleImpact::between`; SID/security-group paths; `Held/NotHeld/Undetermined/NotDeclared` | Role evidence is version-specific and role-scope binding is consumer-owned; don't reinterpret a distribution group as a security group | +| `dir-sim/src/log.rs`, `image.rs`, `lance-graph-dir-sim-lance` | Persist/replay ingredients with logical VersionId distinct from Lance batch versions; torn-save refusal contract | Availability in production does not imply multi-system transaction or tenant snapshot equivalence | +| `crates/lance-graph-contract/src/hotplug.rs` and `class_view.rs` | Per-plug authority activation, checked reading, ordered field basis, WideFieldMask | WideFieldMask is field selection, not row-RBAC or access verdict; slab physical reading is distinct from semantic view | +| `crates/lance-graph-glove-parity/src/awareness.rs` (#1509) | `SoftwareGraph::project` from prepared MethodTable; method/field/program/capability/refusal edges with tier and provenance; Quack Binder | In-memory one-hop projection, caller-supplied revision, limited digest; neither a directory membership store nor persistent general graph engine | +| `crates/lance-graph-quack/src/bind.rs`, `crates/lance-graph-r2il` | `Draft::bind`, Quack lowering into mask-risc; R2IL FoldDialect execution over borrowed planes | Multi-hop relation composition not automatically solved; cannot carry result masks as an undeclared population between programs | +| `crates/lance-graph-rbac`, OGAR `GroupRolePolicy` | Separate policy authority and scope/grant primitives | Not an entitlement-certification UI or PDP/PEP for arbitrary external systems | +| OGAR MethodDecl / `ogar-loco` Inventory / class-method RFC | Source method metadata and keyed body inventory exist; binding composer proposed | `MethodDecl::body_source` is not an executable method; no implicit DO capability | + +[#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509) explicitly leaves **D-SAG-1-4 multi-hop**, **D-SAG-1-6 persistence**, and method identity canonicalization open. Preserve its no-new-opcode/no-second-engine/no-applied-transformation rules. Its H1 SIMD fusion has *not* demonstrated a speedup over the scalar reference. Reuse its `Tier`, `Provenance` and compiler refusals as projected evidence, **not** as a new authority. + +## 2. Map the six IAM functions to typed projections + +| IAM function | Read-only projection / canonical question | Adapter + side-effect boundary | Honest status | +|---|---|---|---| +| IGA (SailPoint, Saviynt) | Identity lifecycle, role/entitlement history, access certification, SoD finding, `why_effective_access?` | HR and entitlement catalogs, review decisions, independent provisioning executor | Core identities/simulation exist, review workflow proposed | +| PAM (CyberArk, BeyondTrust) | `has_privileged_capability?`, `through_which_grant?`, session and approval evidence | Vault/JIT/session products retain privileged access control, recording and rotation | Projection proposed; not a PAM replacement | +| Access/SSO (Okta, Ping) | Federation principal, application assignment, role mapping, conditional access evidence | IdP does authentication, token issuance, MFA and session policy | Read graph proposed; **no SSO** implemented | +| Directory & identity (AD, Entra) | Principal, group, immutable ID, DN location, synced anchor, nested path, what-if membership | Read observations; eventual writes remain external and separately authorized | dir_sim active; cloud correlation depends on available adapter fields | +| Device/app (Intune) | Device ownership, compliant/unknown/noncompliant, app & CA dependencies | MDM supplies compliance, enrollment and enforcement | New domain schema + adapter required | +| Automation (PowerShell, APIs) | Auditable `propose/rehearse/approve/execute/verify/revert` | Capabilities checked at immutable context and just before any external write | Quack/R2IL + plans exist; guarded provider DO seam proposed | + +The marketing categories overlap; none establishes an ontology or guarantees a source can provide every required edge. + +## 3. Minimal IAM graph vocabulary, not a second graph engine + +**Node classes** (concept roles, not a mandate to mint numeric ClassIds): `Identity`, `Group`, `Role`, `Entitlement`, `Resource`, `Application`, `Device`, `Policy`, `Grant`, `Session`, `Evidence`, `Change`. Optional source-specific subtypes (human/service identity, privileged role, tenant, cloud object) are *declared schema refinements* only. + +**Edges** (direction is part of semantic contract): +- `Identity MEMBER_OF Group`, `Group MEMBER_OF Group` (source-specific group type/security semantics, nesting scope, witness); +- `Group GRANTED_ROLE Role`, `Role GRANTS Entitlement`, `Entitlement ALLOWS_ACTION Resource`; +- `Identity ASSIGNED_APP Application`, `Identity USES Device`, `Policy REQUIRES_CONDITION Device/Session`; +- `Grant AUTHORIZED_BY Evidence/Policy`, `Session EVIDENCED_BY Evidence`, `Change DERIVED_FROM Evidence`; +- `ExternalObject CORRESPONDS_TO Identity` only under a reviewed match rule and tenant/sync-anchor evidence. + +**Identity:** source AD object GUID, Entra objectId and external provider UUIDs are *source keys* with their own tenant and namespace. DN is a **mutable location** (not the primary key). UPN, mail, aliases and display names are **attributes**, never joins by default. Distinguish OGAR's canonical NodeGuid and per-view ordinals from external GUIDs; map with explicit provenance, don't cast/repack equal-sized values or silently unify tenants. `ClassId` high-u16 concept and full u32 addressed class are different views per D-CMH-0. + +**Edges are claims:** identity, source/tenant, (valid_from, valid_to), observed_at, source revision, rule revision, completeness/knownness, provenance and verification tier. `Unknown` is not `false`; `observed` is not `authorized`; a hypothetical delta is not an observation. + +**Layered canonicalization:** OGIT canonical field URI and reviewed native alias conversion -> OGAR class/reading authority -> ClassView ordered basis and WideFieldMask for field selection -> Quack numeric binding. Do not equate SAP/Odoo/AD fields by label, and don't move schema semantics into the 8-bit ALU/ISA register contract. CE64, CARE, ONA belief and epistemic tiers can remain contextual readings/evidence policies, not hard-coded identity or action bits. + +## 4. Two graphs, one substrate, no semantic conflation + +**Business/access graph:** version-pinned directory and authority relationships, entitlements, policy provenance and source observations. `dir_sim` governs directory what-if state; versioned GroupRolePolicy remains policy authority. Real IdP/PAM/MDM behavior is modeled as imported evidence, not delegated to `dir_sim`. + +**Software-awareness graph (SAG):** methods, inputs, lowering programs, compiler refusals, capability *claims* and tests from #1509. A proposed IAM `effective_access` method should have a `USES_FIELD`/program dependency projection and can report if it is compiled or refused. A SAG assertion `MayRequire` never supplies an observed entitlement. + +The bridge is a **versioned method binding/receipt**: +`(source snapshot ids, policy version, canonical schema seal, prepared method key, body/plan digest, actor/read scope) -> query result + witness + tier + refusal`. +Use the D-CMH composer, not another metadata registry. Do not mint method identity in this PR. + +**Multi-hop gate:** #1509's one-hop method queries do not implement `Identity -> Group -> Role -> Entitlement`. Compare two legal candidates in D-SAG-1-4/D-CMH-G1-4: (a) typed relation carrier connecting a population output to the next input; (b) factored `EqU32Via` read. Require compiler/Quack/mask-risc parity with a pinned slow reference on cyclic, nested, multiple-path and deleted-edge fixtures. Until one passes, use existing directory membership path logic for directory subgraph and mark broader entitlement closure as proposed. NEVER pipe an arbitrary output Mask as the next program's `LIVE` population. + +## 5. Worked scenario: Anna's accounting entitlement + +Illustrative data, never real personal data: +```text +Principal AD-guid(A), Tenant(T) --MEMBER_OF/security--> GRP_Finance +GRP_Finance --MEMBER_OF/security--> APP_ERP_Accounting +APP_ERP_Accounting --GRANTED_ROLE/policy-v7--> ERP_Write +ERP_Write --GRANTS--> Accounting_Write on ERP_Ledger +Device(D) --COMPLIANCE@mdm-v12--> Unknown +``` + +Requests: +1. `explain_access(A, ERP_Ledger, Write, as_of=V, policy=p7)`: enumerate **all** supporting paths or declare `one witness / nonexhaustive`; include policy, source and snapshot receipt. +2. `revoke_preview(A, GRP_Finance)`: `VersionStore.simulate` on base V, evaluate effective roles for both views with `RoleImpact::between`, compute target entitlement deltas; ensure another valid path preserves access. +3. `why_not_access?`: if the device/CA policy is missing, report `Undetermined/Unknown`, *not* a denial or approval. +4. `propose_action`: stage an inert change with preconditions and impact; policy authority separately gates `approve` and eventual external executor. + +Distinguish **effective graph grant**, **authentication success**, **conditional access evaluation**, and **live enforcement**. A directory membership cannot prove an IdP token was accepted. + +## 6. Method sketch (illustrative, intentionally not a Rust API claim) + +```text +class Identity { memberships, effective_access, access_history, + role_evidence, simulate_removal, reconcile } +class Entitlement { explain, principals, blast_radius, revoke_preview } +class Device { compliance, linked_identities, access_dependencies } +class Grant { policy, witnesses, effective_during } +class Change { preview, validate, approve, execute, verify, revert } +``` + +**Execution class:** `PureRead | VersionPinnedRead | Propose | ExternalMutate` is an RFC name only. `PureRead` and `Propose` use existing Quack/R2IL and dir_sim primitives. `ExternalMutate` is not a Quack opcode and must refuse unless independently authorized, with fresh source preconditions and external connector attestation. An absent field, alias, authority, schema seal, body, read scope, source version, evidence completeness or capability causes an explicit typed refusal. + +## 7. Falsifiers and acceptance matrix + +| ID | Fixture / negative test | Expected oracle | +|---|---|---| +| IAM-01 | Same UPN across tenants, renamed DN | two distinct source keys; stable GUID identity; no accidental join | +| IAM-02 | user -> security group -> nested security group -> role | same effective role and witness as dir_sim `role_evidence` | +| IAM-03 | distribution group in nested chain | no transitive security role gained | +| IAM-04 | two independent routes to the same entitlement; remove one | access remains; lost witness != lost entitlement | +| IAM-05 | unknown group policy (never observed) vs explicitly empty policy | `Undetermined` vs `NotHeld`; cannot certify absence from unknown | +| IAM-06 | stale source observation, policy revision changes mid-query | pinned result or typed `VersionMismatch`; never silently mix | +| IAM-07 | one simulated membership removal + replay | original unchanged; deterministic diff/plan; replay matches; no external IO | +| IAM-08 | revoked and newly minted grant; two time windows | access only inside authorized interval; no time-travel leakage | +| IAM-09 | schema/reading drift or missing required field/validity plane | explicit refusal; no default known/allowed | +| IAM-10 | SAG declares `MayRequire FirstOfRun` but no compiled program | hypothesized/claimed, not shipped; no fabricated authorization | +| IAM-11 | duplicate log/evidence derivations | provenance distinguishes source vs inference; no double confidence count | +| IAM-12 | actor without execute permission; forged approval or policy confidence | all external action attempts refuse, no provider writes | +| IAM-13 | unknown device compliance under conditional-access dependency | indeterminate, not permitted/denied based on guess | +| IAM-14 | cost benchmark of multi-hop vs pinned reference | correctness first, memory/latency measured by dataset and CPU tier; no claimed speedup without data | +| IAM-15 | disable key checks separately (source scope, knownness, external effect gate, witness alternatives, snapshot pinning) | each deliberate mutation makes a named test red | + +Represent each test with source data, sealed schema/policy revisions, `actual`, `expected`, refusal/witness and oracle provenance. Record disable tests rather than merely asserting the guard exists. + +**Two high-value regression models:** (a) duplicate license assignment from competing sources and (b) legitimate user losing a license during reconciliation. Define synthetic inputs and precedence rules, run proposed changes through `dir_sim`; neither incident should be claimed fixed until the relevant semantics and parity tests exist. + +## 8. Execution slices and stop signs + +- **W0 Inventory, no Rust changes:** verify #1509 source/tests, OGAR semantic ownership, dir_sim latest exact APIs, policy version model, Quack relation carrier. Label each contract `[G]`, `[P]`, `[ABSENT]`. Review whether analogous methods already exist before adding one. +- **W1 Typed read-only IAM fixture:** reuse version-pinned `VersionStore`, `GroupRolePolicy`, existing membership/role evidence. Produce explainable `Held/NotHeld/Undetermined` rows with provenance, including one-witness vs all-paths semantics. Pin IAM-01..05. +- **W2 Canonical class/method binding:** compose in existing allowed consumer layer under D-CMH-0, OGIT field identity, ClassView field basis, schema seal, per-plug authority and existing Quack Binder; project methods/actual compiler verdicts into SAG. Pin IAM-09/10 and policy-source separation. +- **W3 Multihop/read-only access impact:** select a legal relation carrier or existing `EqU32Via` plan after oracle comparison; don't introduce a traversal runtime by stealth. Implement two-version before/after and alternate-path cases, pin IAM-04/06..08/13. +- **W4 Optional ONA-style introspective proposer:** SAG can inspect `refusal -> gap -> test -> candidate`; choose what to investigate using declared budget/uncertainty but *never* let an uncertain signal mutate provider state. Keep epistemic confidence, causal hypothesis, and authority separate. Pin IAM-11/12 and ablate the prioritizer against no-observer baseline. +- **W5 Authorized execution (separate PR only):** source authority and RBAC signing, actor-bound scope, reviewed change, idempotency, check-and-set, provider-specific receipts, conflict/refusal and revert feasibility. NO execution in this RFC. + +### W4 observation/control loop (optional) + +```text +observe actual grant/policy evidence -> explain via existing graph + -> identify unverified/undetermined/violating claim (not an enforcement verdict) + -> produce candidate explanation/test/dir_sim delta + -> run read-only counterfactual and dependency ablation + -> label Verified / Refuted / Undetermined with source receipts + -> present proposal for human/provider authority, no automatic DO +``` + +Do not equate Shannon entropy with epistemic uncertainty, policy risk or access authorization; report them as distinct measures. The Rubicon/Heckhausen, ONA, Hyperon metagraph and CARE analogies are **research hypotheses** for investigation priority, not license to repurpose CE64 bits 59..63 or identify a policy action with a belief. + +## 9. Research decisions and traceability + +See [primary-source excerpts](../../.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md) for paraphrased page/section references, direct publication links, transfer limits and falsifiers. Key non-claims: + +- NIST SP 800-162 ABAC and SP 800-207 Zero Trust constrain access evaluation and enforcement; neither validates an IAM product built from a graph query. +- Why-provenance can be computationally hard for recursive queries; do not conflate *one witness* with a complete minimal explanation. +- Temporal RBAC constraints require who/what/when; an immutable snapshot alone does not define real-time authorization. +- Hyperon and NARS are architectural references for self-representation and revisable observation, not security accreditation, a replacement engine, or evidence of subjective cognition. + +## 10. Deliverables for the implementation successor PR + +- A code-grounded contract matrix and accepted naming/authority for canonical IAM concepts. +- A small sealed synthetic dataset and a strict reference evaluator for graph access/role impact. +- Read-only method projections whose compiler proofs/refusals appear in SAG, not hand-authored 'Verified' tiers. +- IAM-01..15 test matrix with disable/falsification evidence; one passing end-to-end `explain -> simulate -> re-evaluate -> propose` demo. +- Measurement table (baseline, candidate, environment, versions) before any performance claim. +- Security review showing external provider writes impossible in read-only mode; no unreviewed policy/byte-layout/ISA drift. From bcd79ea045a43aa3018b71378103df07bb9e561e Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:14:40 +0200 Subject: [PATCH 02/13] research: add primary-source IAM provenance and policy excerpts --- ...hs_temporal_provenance_primary_excerpts.md | 102 ++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 .arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md diff --git a/.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md b/.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md new file mode 100644 index 000000000..00ccb40b8 --- /dev/null +++ b/.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md @@ -0,0 +1,102 @@ +# IAM access paths, temporal policy and provenance: primary-source excerpts + +**Date:** 2026-10-12. **Status:** sourced research distillation / transfer hypotheses, **not** implementation evidence. **Base:** [merged lance-graph #1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509). **Application plan:** [D-IAM-SAG-0](../.claude/plans/iam-substrate-sag-dir-sim-v1.md). + +**Method.** Short **paraphrased** excerpts (Exzerpt / sinngemäß), with section or abstract locator; exact source URLs, what the author establishes, what remains speculative for OGAR/dir_sim/lance-graph, and a concrete falsifier. We do not transfer formal guarantees merely because vocabulary matches. arXiv preprints are not all peer-reviewed; NIST and Frontiers are non-arXiv primary sources included because access semantics and NARS require them. Read existing [Hyperon excerpt](2026-10_hyperon_metagraph_folds_chronomorphisms_primary_excerpts.md) and [NARS evidence excerpt](2026-10_nars_self_epistemic_needs_evidence_primary_excerpts.md) instead of duplicating entire papers. + +## P1. Why-provenance is a set of sufficient witnesses, not a path label + +**Source:** Calautti, Livshits, Pieris, Schneider (2023), *The Complexity of Why-Provenance for Datalog Queries*, [arXiv:2303.12773](https://arxiv.org/abs/2303.12773); abstract and complexity results in full text. + +**Exzerpt, abstract (paraphrase):** Why-provenance explains an answer through subsets of input facts sufficient to derive it. Recursive queries pose harder computational problems than many nonrecursive fragments; the paper establishes intractability for recursive cases it studies, even certain restricted recursive forms. It also explores practical solving approaches. + +**Transfer to IAM [H]:** `Identity->Group->Role->Entitlement` needs a witness contract: (a) *one concrete sufficient witness* for a positive role, (b) *all witnesses* if making a disappearance claim after removal, or (c) an explicitly bounded search. In `dir_sim::actors`, `RoleEvidence::Held` already returns one (shortest) SID-chain witness, and its documentation correctly says this is not the only reason. Reuse `RoleImpact::between` to decide actual role loss. + +**Falsifier:** grant one entitlement by two edge-disjoint paths, remove one path, and verify the explanation changes while effective access stays. Declare a path enumeration budget and prove an unfinished search cannot be reported as complete absence. The paper **does not** prove a specific Query/Masks implementation or supply an IAM authorization oracle. + +## P2. Temporal roles must satisfy policy and timing together + +**Source:** Combi, Viganò, Zavatteri (2015), *Security Constraints in Temporal Role-Based Access-Controlled Workflows (Extended Version)*, [arXiv:1512.06404](https://arxiv.org/abs/1512.06404); abstract, temporal role/workflow mappings and security constraint sections. + +**Exzerpt, abstract (paraphrase):** The authors integrate role timing and temporal workflow constraints, determine which users can perform tasks, and describe runtime propagation of security constraints. + +**Transfer [H]:** a directory snapshot VersionId, a policy revision, a grant's effective interval and an observed-at timestamp play different roles. A replay of `V7` at a historical policy version is an *analytical question*, not permission to execute a change now. The latest external PDP still decides live authorization. + +**Falsifier:** membership is true at both t0 and t1, policy grants only [t0,t1); an as-of query and an execution request at t1 must differ. Also test an observation arriving late and policy revision changing mid-simulation. The paper does not endorse a particular two-clock encoding or guarantee eventual-consistency safety. + +## P3. Aggregating an access explanation requires explicit provenance semantics + +**Source:** Amsterdamer, Deutch, Tannen (2011), *Provenance for Aggregate Queries*, [arXiv:1101.1110](https://arxiv.org/abs/1101.1110); abstract and sections introducing aggregate provenance. + +**Exzerpt, abstract (paraphrase):** Provenance for aggregate computations cannot in general be handled by naïvely using ordinary tuple annotations; provenance may need to attach to values involved in a computation, and extensions to positive relational algebra with aggregates have additional difficulties. + +**Transfer [H]:** IAM review dashboards count people, grants, risky roles and duplicated licenses. Distinguish bag count from distinct canonical identity count; attach evidence to the source values/derivation and preserve group-role policy version. An `any(path)` witness is not a `count(distinct principals)` proof. The typed `SoftwareGraph` in #1509 already distinguishes bag-versus-set semantics in its falsifiers. + +**Falsifier:** same principal reaches one role via two paths, two source aliases and two time windows. Counts of entitlements, paths and distinct principals must differ by design; policy conclusions must be invariant under reordering of duplicate evidence and explicit about the chosen unit of counting. + +## P4. Hyperon: reflect on the methods, not a second IAM engine + +**Source:** Goertzel et al. (2023), *OpenCog Hyperon: A Framework for AGI at the Human Level and Beyond*, [arXiv:2310.18318](https://arxiv.org/abs/2310.18318), especially metagraph representation/rewriting and self-modification discussion (§3.1.3 and surrounding architecture). Related formal proposal: Goertzel (2021), *Reflective Metagraph Rewriting as a Foundation for an AGI "Language of Thought"*, [arXiv:2112.08272](https://arxiv.org/abs/2112.08272), abstract. + +**Exzerpt (paraphrase):** Hyperon proposes metagraphs to represent knowledge and cognitive processes; a reflective language can treat its own programs/rewrite rules as graph-represented subjects of computation. These are architectural proposals and directions, **not** a demonstrated runtime parity result for lance-graph or a security certification. + +**Transfer [H]:** #1509's `SoftwareGraph` already projects prepared methods, lowering programs and compiler refusals as typed rows queried by Quack. Model an IAM method's dependency and test evidence in the *software graph* while the actual effective access is computed from the *directory/authority graph*. Link via a versioned method/plan receipt, not a second runtime, and never turn SAG `Tier::Hypothesis` into an entitlement. + +**Falsifier:** declare a hypothetical optimization method with no compiled body; SAG must distinguish *declared*, *compiled*, *verified*, *refused*, and *hypothesized*. Reproject after changing the method seal and invalidate stale evidence. A typed graph description does not itself execute `do()`. + +## P5. NARS/ONA: introspection is revisable evidence, not provider authority + +**Source:** Wang, Li, Hammer (2018), *Self in NARS, an AGI System*, *Frontiers in Robotics and AI* 5:20, [DOI:10.3389/frobt.2018.00020](https://doi.org/10.3389/frobt.2018.00020), §§2, 3.1–3.5. Related implementation: [OpenNARS for Applications](https://github.com/opennars/OpenNARS-for-Applications). Existing deeper paper audit: [NARS excerpt](2026-10_nars_self_epistemic_needs_evidence_primary_excerpts.md). + +**Exzerpt, §§2–3 (paraphrase):** NARS operates under insufficient knowledge/resources, builds revisable self-knowledge using internal events and reasoning traces, and treats mental operations as a supplement to normal inference control. The article's implementation discussion is not a demonstration of subjective awareness. + +**Transfer [H]:** an optional IAM observer consumes `Undetermined`, `RefusedFor`, missing evidence and historical mismatches to rank *read-only probes*: inspect another source, run a `dir_sim` counterfactual, request review. Keep statistical surprisal, confidence in an inferred claim, and enterprise authorization in separate planes. Self-observation of a change proposal is not an approval event. + +**Falsifier:** same evidence under observer-on and observer-off; compare discovery coverage, false alerts, CPU time and effect on factual IAM output. Observer state may prioritize *questions*, but must not alter the ground-truth role-evidence oracle or bypass an effect gate. + +## P6. Dependent evidence cannot be added as independent evidence + +**Source:** Jøsang (2007), *Cumulative and Averaging Fission of Beliefs*, [arXiv:0712.1182](https://arxiv.org/abs/0712.1182), abstract and fusion/fission sections. Existing detailed distillation: [NARS evidence excerpt](2026-10_nars_self_epistemic_needs_evidence_primary_excerpts.md). + +**Exzerpt (paraphrase):** Different fusion laws apply according to whether evidence has independent or shared provenance; fission examines the effect of removing a known contribution under explicit algebraic preconditions. These are Subjective Logic rules, **not** NARS or CE64 byte-laws. + +**Transfer [H]:** a principal's license status observed through AD sync and Entra sync may originate from one upstream change. Do not count the two read surfaces as independently corroborating the same change. Retraction/ablation of one upstream fact should account for downstream duplicates. The immutable source identity and replayable observation receipt are the meaningful inputs. + +**Falsifier:** one observation reported by two adapters vs two truly independent observations; adding a duplicate must not increase evidence confidence. Attempting exact inverse confidence from only saturated u8 values must refuse or report bounds, not fabricate certainty. + +## P7. ABAC is an authorization evaluation, not a graph association + +**Source:** Hu et al., NIST SP 800-162 (updated 2019), *Guide to Attribute Based Access Control (ABAC) Definition and Considerations*, [DOI:10.6028/NIST.SP.800-162](https://doi.org/10.6028/NIST.SP.800-162); [NIST publication](https://csrc.nist.gov/pubs/sp/800/162/upd2/final), abstract and §2. + +**Exzerpt, abstract (paraphrase):** ABAC evaluates subject, resource/object, action and possibly environment attributes against policy rules or relationships. This is **more** than the existence of a directory edge. Attributes require validity, provenance and decision context. + +**Transfer [H]:** `member_of` may imply a policy candidate but cannot by itself decide conditional access; unknown device compliance and unverified session posture block a fully determined decision. Use ClassView/WideFieldMask for read fields, not as a permission mask. Refuse missing policy context, and keep the IdP/PDP as policy authority. + +**Falsifier:** same identity/group path on one compliant and one unknown-compliance device. Graph entitlement can be equal; policy decision becomes permitted/undetermined under a specified policy. Cannot equate a graph association with a successful SSO session. + +## P8. Zero Trust keeps enforcement separate from analytical proposals + +**Source:** Rose et al. (2020), NIST SP 800-207, *Zero Trust Architecture*, [NIST PDF](https://doi.org/10.6028/NIST.SP.800-207), §§2–3 and policy decision/enforcement point description. + +**Exzerpt, §§2–3 (paraphrase):** Access to enterprise resources is mediated by a policy decision point (PDP) and policy enforcement point (PEP), using subject/request context and enterprise policy; network or directory membership alone does not establish trust for all future interactions. + +**Transfer [H]:** Quack may evaluate read-only graphs, OGAR/dir_sim may simulate, and SAG may propose tests. The live SSO/PAM/MDM or directory provider still enforces; an external mutation has a separate actor-bound authorization and precondition check. Inference confidence is not an execute grant. + +**Falsifier:** inject a `Tier::Verified` optimization receipt, forge a policy-looking graph edge or replay a historical approval. All three must fail to produce a provider write without fresh external authorization. A policy simulation cannot certify that a third-party enforcement system will behave identically. + +## Source and transfer ledger + +| Work | Authoritative for | Not evidence for | +|---|---|---| +| arXiv:2303.12773 | complexity/meaning of why-provenance witnesses | automatic complete IAM explanations | +| arXiv:1512.06404 | role/workflow timing constraint models | chosen directory timestamp layout | +| arXiv:1101.1110 | aggregate provenance pitfalls | a particular Quack aggregate implementation | +| arXiv:2310.18318 / 2112.08272 | reflective metagraph language/architecture | new engine necessity, measured AGI | +| Wang et al. 2018 / ONA | internal-event traces and revisability | IAM authorization, phenomenal selfhood | +| arXiv:0712.1182 | evidence fusion/fission assumptions | byte-compatible NARS/CE64 truth rules | +| NIST 800-162 | attribute-policy model | proof an entitlement is allowed | +| NIST 800-207 | PDP/PEP and zero-trust architecture | replacement for an active IdP | + +**High-signal conclusion:** the core research-backed contract is a triangle: **sufficient provenance witnesses × version-pinned temporal policy × separately enforced authority**. Graph introspection helps discover *questions* and *counterfactuals*, not a shortcut through either formal witness completeness or an authorization boundary. + +**Open questions for the implementation PR:** (1) exact carrier for multi-hop; (2) how to expose and bound witness completeness; (3) version join for dir_sim + GroupRolePolicy + MDM; (4) where OGAR/OGIT identity mapping authority lives; (5) what counts as a verified compiler certificate vs a claimed capability; (6) which provider operations remain only simulated. From 3e8829325583e6cbd6e99028b5e90af62e946120 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:15:35 +0200 Subject: [PATCH 03/13] docs: add Claude Code implementation prompt for IAM SAG follow-up --- .claude/prompts/iam-substrate-after-1509.md | 70 +++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .claude/prompts/iam-substrate-after-1509.md diff --git a/.claude/prompts/iam-substrate-after-1509.md b/.claude/prompts/iam-substrate-after-1509.md new file mode 100644 index 000000000..99bc88104 --- /dev/null +++ b/.claude/prompts/iam-substrate-after-1509.md @@ -0,0 +1,70 @@ +# Claude Code implementation prompt — D-IAM-SAG-0 (start from merged #1509) + +> Use this as an **implementation-session prompt**, not as an instruction to deploy/write to any identity provider. The present PR is documentation only. Start from the then-current `main`, which must contain [#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509); record actual SHAs before code changes. If the interfaces have changed, report drift rather than applying this prompt verbatim. + +## Mission + +Explore and, where evidence permits, implement a **small read-only IAM reasoning slice** over existing `lance-graph-dir-sim`, OGAR policy, Quack/mask-risc and the #1509 Software Awareness Graph. The six marketing categories (IGA, PAM, SSO, Directory, Device/App, Automation) are *domain views*, not six products to build. Deliver a reproducible access-path explanation and before/after permission-impact simulator with strict provenance, not a replacement for SailPoint, CyberArk, Okta, Ping, Entra or Intune. + +**Must read first:** +1. `.claude/plans/iam-substrate-sag-dir-sim-v1.md` +2. `.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md` +3. `.claude/plans/software-awareness-graph-v1.md`; `crates/lance-graph-glove-parity/src/awareness.rs`, `tests/awareness.rs` +4. `.claude/plans/class-method-schema-hotplug-v1.md` and `.claude/knowledge/class-method-hotplug-existing-contracts.md` +5. `crates/lance-graph-dir-sim/src/{lib,store,view,actors,snapshot,validate,image,log}.rs` +6. `crates/lance-graph-quack/src/bind.rs`, `crates/lance-graph-rbac/src/lib.rs`, `.claude/plans/dir-sim-persist-v1.md`. +7. Relevant OGAR authority: `ogar-dir-sim`, `ogar-rbac::group_policy`, `ogar-loco::Inventory`, `OGAR #357` (only if current code confirms those imports). + +## Strict method + +- **Audit before writing.** Produce a row-by-row `[G] grounded code / [P] proposal / [ABSENT] missing` matrix for all functions and authority boundaries. List file:line, exact tests and versions; prior plans can be stale. Confirm #1509's one-hop limitation; check D-SAG-1-4 and D-CMH-G1-4 status on current main. +- **No duplicate engine, catalog, registry or opcode.** No graph traversal in bespoke Rust loops unless it is an explicit bounded reference oracle for tests. Extend an existing valid relation carrier / `EqU32Via` approach only after parity proof; never feed an output mask into a second program as an undeclared population. +- **No authority drift.** OGAR owns classes/action semantics; OGIT owns imported canonical field identity; `GroupRolePolicy` owns group-role grants; `dir_sim` owns hypothetical directory state; external IAM/PAM/IdP/MDM remain enforcement sources. +- **No semantic byte drift.** The 8-bit lanes are the substrate ISA/ALU register contract. Do not reinterpret them as universal NARS/CARE/IAM semantics, modify CE64 bits 59..63, or conflate full u32 class identity with the high-u16 canonical concept. +- **No side effects.** Do not call PowerShell, Azure Graph write APIs, LDAP modifications, PAM sessions or provisioning connectors. `do()` / ActionDef remains inert until a later separately authorized PR. No new network I/O path is permitted in `lance-graph-dir-sim`. +- **Security fail-closed.** No missing-policy->allow, unknown->false, distribution-group->security-group, forged-method->verified, schema mismatch->default, confidence->permission, or time-travel replay->live authorization. + +## Proposed sequence, narrow increments + +**A. Inventory + fixture first.** Build a synthetic tenant (Anna, Finance, ERP_Accounting) with source GUIDs, DN, two possible membership paths, one directory distribution group, one policy grant, one missing policy, a device with unknown compliance and a separate immutable source observation. Declare source version, policy revision and observed_at. + +**B. Pin the existing role oracle.** Ask dir_sim GroupRoles/role_evidence and RoleImpact::between before/after a simulated `RemoveMembership`; record `Held/NotHeld/Undetermined/NotDeclared`, witness and alternate path. Ensure simulation does not mutate base observations. Prefer reusing existing tests and adding a consumer-level contract test, rather than reimplementing role traversal. + +**C. Introduce the minimal *read-only* canonical IAM projection**, if justified. Source GUID, Entra objectId, sync anchor, tenant and mutable DN must remain different concepts. Explicit edges `MEMBER_OF`, `GRANTED_ROLE`, `GRANTS`, `REQUIRES`, `EVIDENCED_BY`, `DERIVED_FROM` with version/knownness; do not mint global new IDs where the native GUID can be held as a typed source key. Explicitly label `one-witness` or `exhaustive`. + +**D. Link methods to SAG with actual compiler evidence.** If a `MethodSpec` can be prepared, project it using #1509's `SoftwareGraph::project`. Source of evidence must be `MethodTable::prepare`, real lowered program and observed tests. No generic IAM method table cloned from a diagram; no hand-written `Verified` edge or `MayRequire` claiming shipped behavior. Include one refused method for incomplete field/reading/policy. + +**E. Check multi-hop legally.** Compare relation carrier vs `EqU32Via` using a small known-reference evaluator; refuse or document blocked if neither existing lowering can carry two-hop queries. Do **not** write a shadow DFS/BFS execution engine to make the demo seem green. An existing directory membership path API is allowed only within its own declared semantics. + +**F. Counterfactual and impact.** Run `observe -> simulate -> validate -> diff -> role impact -> explain -> propose` entirely in memory. Model alternate grant and policy revision changes. Distinguish a path disappearing, a role disappearing, a graph entitlement disappearing, and real IdP access being denied. The latter is unknown without actual enforcement evidence. + +**G. Optional observer (separate experimental module/doc, never authority).** Inspired by NARS/ONA and Hyperon, inspect SAG refusals, undetermined policies and non-independent evidence. Rank a *read-only query or ablation* by budget and declared uncertainty. Compare to no-observer baseline; avoid psychological/metacognitive adjectives as claims of implementation. Rubicon pre/post-decision and CARE/CE64 readings are analogies for staged probes, not substituted policy gates. + +## Mandatory falsifiers + +Implement or visibly report blocked for IAM-01..15 in the plan; in particular: +- cross-tenant UPN alias collision / DN rename; +- nested security vs distribution group; +- two valid access paths and one deleted; +- absent grant-policy observation vs explicit empty policy; +- inconsistent source/policy versions; +- three-valued device compliance; +- missing validity plane and stale schema seal; +- simulated state leaves original untouched and replay matches; +- counted duplicate source events do not inflate corroboration; +- attempted DO with no permission cannot reach any provider connector. + +For each implemented guard, disable it once in an isolated run and confirm its named test goes red; restore afterwards. If a test is green after disabling its guard, improve the test before claiming coverage. + +## Results and communication + +Deliver: +1. A concise baseline table with exact existing/absent boundaries, including #1509 one-hop + SAG in-memory limits. +2. Changed files and the *one smallest* implementation slice; keep separate follow-on issues/PRs for multi-hop, device/IdP adapters and authorized effects. +3. `cargo test` / `cargo clippy` commands and actual pass/fail counts for relevant crates, including workspace-exclusion caveats. Never invent metrics. +4. One runnable end-to-end `explain -> simulate -> compare` example with observable provenance and expected refusal. +5. A red/green falsifier ledger with disable-run evidence. +6. An updated plan with tests, method/source revisions and a security statement about why provider writes are impossible. +7. An **OPEN questions** table where data is unavailable; do not replace missing evidence with inference. + +**Definition of done:** one well-specified, tested, read-only IAM access-path/impact claim and SAG-aware method evidence, with no second engine and no unproved external authority. If it cannot compile legally, deliver an explicit, code-grounded blocker instead of a fake implementation. From c108237170b170bf798816cb34c7fa3fa0df6805 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:16:00 +0200 Subject: [PATCH 04/13] docs: add IAM substrate planning board entry --- .../2026-10-12-iam-substrate-sag-dir-sim.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md diff --git a/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md new file mode 100644 index 000000000..85b7fb244 --- /dev/null +++ b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md @@ -0,0 +1,32 @@ +# 2026-10-12 — D-IAM-SAG-0: six IAM views over dir_sim and #1509 SAG + +**Status:** RFC / RESEARCH-ONLY; no code, benchmark, provider write, or IAM policy change in this PR. **Base:** merged [#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509), merge SHA `42fa2a347cda22eaaa327bba514f2029cc9daa82`. + +**Plan:** [iam-substrate-sag-dir-sim-v1](../../plans/iam-substrate-sag-dir-sim-v1.md). **Research:** [primary-source IAM excerpts](../../../.arxiv/2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md). **Prompt:** [Claude Code implementation handoff](../../prompts/iam-substrate-after-1509.md). + +## Decision + +Treat IGA, PAM, access/SSO, directories, device/app and automation as **overlapping projections** of a typed, provenance-aware IAM graph, never as functions automatically supplied by the graph itself. Reuse OGAR/dir_sim, GroupRolePolicy, ClassView/WideFieldMask, Quack/R2IL and #1509 SAG. The native provider retains authentication, sessions, policy enforcement and live-write authority. + +## Concrete existing contracts + +- `dir_sim::VersionStore` observes/simulates/diffs/plans over immutable roots plus delta overlays. +- `dir_sim::actors` provides source-version-specific group-role evidence, indeterminate policy states, and role impact. +- #1509 `SoftwareGraph` projects prepared methods/compiled programs/provenance tiers and offers Quack one-hop queries; it is in memory and does not yet implement multi-hop composition. +- D-CMH-0 specifies a per-plug class/field/method binding seam; OGAR #357 is an RFC, not production executor. + +## Work gates + +| ID | Planned slice | First falsifier | +|---|---|---| +| D-IAM-SAG-0-0 | source, authority and identity inventory | AD GUID != DN, Entra objectId and alias cannot silently unify | +| D-IAM-SAG-0-1 | read-only role provenance and impact fixture | alternate path preserves access; never-read group remains Undetermined | +| D-IAM-SAG-0-2 | class/method binding and SAG projection | missing field, stale seal and uncompiled method explicitly refuse | +| D-IAM-SAG-0-3 | legal multi-hop entitlement explanation | parity vs oracle; no output-Mask-as-LIVE shortcut | +| D-IAM-SAG-0-4 | temporal policy, device evidence and proposal | unknown compliance never becomes allow | +| D-IAM-SAG-0-5 | optional ONA/Hyperon-inspired probe prioritization | observer ablation never changes policy authority | +| D-IAM-SAG-0-6 | authorized DO boundary, separate PR | forged confidence/approval cannot generate provider write | + +**Principal boundaries:** observed ≠ inferred ≠ authorized; one provenance witness ≠ exhaustive proof; group membership ≠ successful SSO; simulated role impact ≠ executed revocation; append-log version ≠ observation/policy effective time. No new ISA bit reading or CE64 mutation. + +**Implementation expectation:** execute [the prompt](../../prompts/iam-substrate-after-1509.md) against actual code, ship narrow test-pinned W1/W2 first, and leave unfinished integration explicitly open. From d6102b9ca0b120df7895a3634f436cbf279eb312 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:30:37 +0200 Subject: [PATCH 05/13] docs(iam): add deeper proof and authority frontier to #1512 --- .../plans/iam-substrate-frontier-gaps-v1.md | 243 ++++++++++++++++++ 1 file changed, 243 insertions(+) create mode 100644 .claude/plans/iam-substrate-frontier-gaps-v1.md diff --git a/.claude/plans/iam-substrate-frontier-gaps-v1.md b/.claude/plans/iam-substrate-frontier-gaps-v1.md new file mode 100644 index 000000000..6ab64fe19 --- /dev/null +++ b/.claude/plans/iam-substrate-frontier-gaps-v1.md @@ -0,0 +1,243 @@ +# D-IAM-SAG-1 — Frontier addendum: negative proof, temporal authority, and safe introspection + +> **2026-10-12 / RFC only / deliberately unshipped architectural hypotheses.** Extends [D-IAM-SAG-0](iam-substrate-sag-dir-sim-v1.md) in draft [#1512](https://github.com/AdaWorldAPI/lance-graph/pull/1512), based on merged [#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509). [Primary literature and standards excerpts](../../.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md). Existing [Claude implementation prompt](../prompts/iam-substrate-after-1509.md) is extended accordingly. +> +> **Status discipline:** [G] = confirmed in cited code or #1509; [R] = result from cited paper/standard **within its own assumptions**; [H] = proposed mapping not proved in lance-graph; [B] = implementation blocker. An RFC is not implementation. No change to existing ISA/byte contract, OGAR/OGIT mint, any directory schema or authorized provider behavior. + +## 0. The question #1512 did not fully resolve + +**How can a read-only graph explain both permission and *its absence*, distinguish an incomplete observation from a negative fact, and propose a safe smallest change without accidentally becoming the authority it observes?** + +A minimal `Identity MEMBER_OF Group GRANTED_ROLE Role` path is enough to *witness* a graph grant. It is insufficient to prove that: +- no other grant path survives removal; +- an explicit deny has higher precedence than an allow; +- all authoritative sources have been observed; +- the device, network, session and time restrictions hold; +- an externally authenticated session was actually accepted; +- a proposed action is currently authorized or reversible. + +The addendum separates **evidence closure**, **decision semantics**, **causal impact**, **operational execution** and **cognitive prioritization** as independent proof obligations. + +## 1. Three separate results (do not coerce to bool) + +Proposed *analytical* result sidecar, not a new zero-dependency `lance-graph-contract` type: + +```text +GraphEntitlement = + Witnessed{one_or_more_paths, completeness: WitnessScope} + | AbsentUnderClosedWorld{scope, source_versions, exhaustiveness_proof} + | Undetermined{missing_sources_or_policy} + | Conflicted{incompatible_observations} + +PolicyEvaluation = Permit | Deny | NotApplicable | Indeterminate + + selected_combining_algorithm + policy_version + obligations/advice + +ProviderEnforcement = ObservedAccepted | ObservedRejected | NoObservation + + provider + session/request id + expiry + observed_at +``` + +`Deny` is not `NotApplicable`; `NotApplicable` is not `Undetermined`; *absence of a row* is not an authoritative negative unless the relevant source/query has a complete and scoped negative certificate. The policy-combining algorithm is source-specific and versioned. Never choose `deny-overrides` by default merely because a paper or an IAM product supports it: XACML 3.0 has several algorithms and a richer Indeterminate space. [OASIS XACML 3.0](https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html) is the reference contract [R], not evidence of a shipped XACML engine in LG [H]. + +**Existing nearby [G]:** `dir_sim::actors::RoleEvidence` already distinguishes `Held`, `NotHeld`, `Undetermined`, `NotDeclared` for a declared role under its own documented group-policy completeness checks. The proposed cross-domain proof is a *narrow extension*, not a reinterpretation of that API. + +### Completeness as first-class evidence [H] + +Represent read scope and coverage for each authority: + +```text +ObservationCoverage { + source, tenant_or_realm, object_kinds, predicate_subset, + snapshot_or_cursor, page_window, source_version, + authoritative_for, complete: yes|no|unknown, + observed_at, read_scope, retention_policy +} +``` + +A successful paginated read can still be incomplete (partial sync, missing page, insufficient privileges, filter mismatch). Closed-world negative proofs require **all relevant** sources, policy domains and time intervals to be complete, not merely one green source read. Distinguish `Some([])` from `None` in OGAR GroupRolePolicy as current dir_sim already does. + +**Falsifier IAM-16:** remove a data page containing the alternate granting path. An apparent `Absent` must become `Undetermined`; never permit deletion just because the narrower observation looks empty. + +## 2. Four temporal coordinates and a coherent authority vector [H] + +Never equate: +- **valid/effective time:** when the grant, role, device compliance or policy purports to apply; +- **observation time:** when a source response was obtained; +- **record/ingest time:** when this fact was durably appended; +- **decision/execution time:** when a caller asks or an external PDP authorizes an action. + +Persist a coherent query envelope, conceptually: + +```text +QueryEnvelope { + source_versions: {AD:v7, Entra:e12, HR:h5, MDM:m8}, + policy_versions: {group_role:p9, conditional_access:ca3}, + canonical_schema_seal, prepared_method_seal, + effective_as_of, read_snapshot_horizon, observation_cutoff, + scope, tenant, query_purpose, witness_budget +} +``` + +Source versions form a **vector**, not a single global monotonically increasing `VersionId`. An atomic multi-system snapshot is **not** established simply because each source was read at some time. A user request may: +1. Refuse a consistency-sensitive conclusion with `MixedVersion`; +2. report bounds as of a declared observation cut; or +3. use an explicitly weaker “best-effort” comparison with stale-source badges in a UI (never silently promote to verified live access). + +Tests: out-of-order observations, policy edited between two reads, source clock skew, delayed HR termination, v7 replay after provider has advanced to v9. A historical positive should never silently become a *present* execution grant. + +## 3. Identity equivalence as a *proofed relation*, not string equality [H] + +`ExternalIdentityBinding(source, namespace, tenant, source_guid, canonical_id, link_rule, rule_version, verified_anchor, confidence/status, valid_interval)` is a relation, not a claim that equal UPN/displayName/mails are unique. DN is location. ObjectId (Entra), objectGUID (AD), SCIM id, hrPersonId, app account id and workload principal are different identities until explicit verified mapping. + +**Crucial counterexample:** A AD and B cloud share `anna@example.com` during reassignment; a former user's SIDHistory could grant access. A naive coalescing keyed on mail merges two people and falsely preserves authorization. Another: two authoritative AD forests yield equal-looking `sAMAccountName`; never cross realm boundary. + +Only treat `same_actor` as equivalence *inside declared scope*, from an approved anchor rule. A link's confidence belongs to epistemic matching, **not** RBAC delegation. Transitivity of `CORRESPONDS_TO` needs a separately proven anchor logic; otherwise collision chains A≈B≈C can create privileges. + +**IAM-17/18:** UPN reuse or source-namespace collision cannot merge identities; ambiguous many-to-many binding explicitly refuses inherited roles. Include machine/service identities, managed identities, API principals and emergency accounts; do not assume every principal has a human HR lifecycle. + +## 4. Access paths form an AND/OR proof, not a simple line [H] + +A grant chain may require *all* conditions (member AND active policy AND correct device AND within time) while authorization can have *alternative* paths (group A OR role B). Policy **deny** may override multiple valid grant witnesses. Standard provenance polynomial intuition is helpful, but Boolean edge reachability alone loses constraints and can leak sensitive intermediate memberships. + +Proposed normalized explanation: + +```text +EntitlementClaim(actor, action, object, context) + Witness(W1) = member(A,G1) AND security_enabled(G1) AND grant(G1,R) + AND role_allows(R,action,object) AND policy(p1) + Witness(W2) = direct_app_assignment(A,app) AND app_role(app,R) + Constraints = effective_time AND device_posture AND explicit_exclusions + Unknowns = unread_policy, stale_session, unresolved_anchor ... +``` + +**One witness vs complete support:** `RoleEvidence::Held` supplies a *concrete* path, not a full provenance enumeration. For `revoke_preview`, evaluate effective role/entitlement **before and after** using the existing versioned oracle. Do not infer loss from the disappearance of a chosen witness. Cycle detection and a bounded witness budget are mandatory. + +**Negative explanations:** use “failed derivations + completeness” for `why_not_access?`, not merely no positive path; [arXiv:1701.05699](https://arxiv.org/abs/1701.05699) provides a database provenance research model for failure/negation [R], not an OGAR implementation guarantee. + +**Cut sets / minimal interventions:** propose a *candidate* set of changes that disables all surviving grant paths **subject to** SoD, business continuity and effect-authority constraints. Minimum-cardinality cut is not necessarily least-risk intervention. Counterfactual success does not prove a causal claim about observed production session behavior. + +**IAM-19/20/21:** double-path removal preserves access until both paths are closed; empty role result with incomplete sources remains Unknown; explicit deny + permit respects the selected external policy algorithm. + +## 5. Approval, SoD and lifecycle as temporal policy, not attributes [H] + +Represent: +- **Separation of duties:** mutually exclusive capabilities, policy authority and expiry; include combinations of directory + app roles, not just group names. +- **JIT/PAM:** grant/approval with time-to-live, one-time session authorization, break-glass purpose, session receipts; approval ≠ privilege issuance, issuance ≠ session accepted, revocation ≠ session termination. +- **Joiner/Mover/Leaver:** HR effective time, account creation and delayed deprovisioning; a mover can both lose and gain privileges with a risky overlap window. +- **Nonhuman lifecycle:** app secrets, service account owner, key rollover, workload identity, orphaned automation privileges; never treat a robot identity as a human with no HR record. +- **Delegation and impersonation:** actor, on-behalf-of principal, scope, consent, session and authority must stay separate; propagated identities do not authorize their own scope expansion. + +**Policy robustness question:** can a pending role assignment or a later independent policy extension violate a proved SoD invariant? [arXiv:2603.13181](https://arxiv.org/abs/2603.13181) studies robust policy properties under extension [R]. Transferring its logic requires an explicit policy language and proof rules [H]. A one-time point-in-time check is not a proof under all possible policy changes. + +**IAM-22/23/24:** SoD remains violated even when conflicting roles derive from different sources; expired JIT grant fails before actual execution; a new policy extension invalidates a certificate unless it satisfies the proved stability preconditions. + +## 6. A provider operation is an audited protocol, not a mask-risc side effect [H] + +Keep `D-IAM-SAG-0` read-only. A *future separate PR* can specify: + +```text +ProposedChange -> SimulatedImpact -> Human/Policy Approval + -> Fresh Authorization (actor+resource+verb+scope+purpose) + -> Provider Preconditions (source ETag/version, policy rev, target identity) + -> External Call (idempotency strategy, declared retry semantics) + -> Provider Receipt -> Re-observation -> Verified/Unverified outcome + -> Optional compensating proposal +``` + +At every step, keep `requested`, `approved`, `applied`, `verified` distinct. A failed or timed-out provider call creates **UnknownOutcome**, not “not applied”, because retry can duplicate side effects. Compensation can fail and is not automatically rollback of all consequences. + +**SCIM interoperability:** [RFC 7643](https://www.rfc-editor.org/info/rfc7643) defines its resource model; [RFC 7644](https://www.rfc-editor.org/info/rfc7644) covers PATCH, conditional ETags and optional provider capabilities. SCIM PATCH is atomic **for one resource request** in the described protocol; this is not a multi-provider transaction. Conditional `If-Match` depends on provider support. Do not generalize that all Graph/AD/PowerShell endpoints support it. + +**IAM-25/26/27:** stale ETag refuses mutation; timeout after provider success yields UnknownOutcome requiring re-observation before retry; compensating a group change does not claim to terminate existing IdP/PAM sessions. There are zero external calls in the documentation PR. + +## 7. SAG method evidence and safety-proof boundary [H] + +[D-SAG-1](software-awareness-graph-v1.md) projects prepared MethodTable methods, lowered programs and compiler refusals. It **does not** establish that a method may read every tenant's identities or execute a privileged action. + +Propose a *sidecar receipt*: + +```text +PreparedIAMRead { + method_key, class_full_id, schema_seal, semantic_reading, + source_versions, policy_versions, required_field_mask, + row_scope_and_actor_context, compiler_verdict, body_digest +} +``` + +- `WideFieldMask` selects **columns**; tenant-/actor-scoped row authorization is an independent predicate/gate. +- `Tier::Compiled` proves a lowered program exists, not correct domain meaning. `Tier::Verified` needs real oracle/certificate including source versions and query scope. +- `Tier::Hypothesis` never becomes `authorized` even if confidence is high. +- The Quack one-hop limit remains [B] for general entitlement closure; use existing `dir_sim::actors` only for its scoped role evidence. `D-CMH-G1-4` / `D-SAG-1-4` relation carrier remains open. + +**IAM-28/29:** same method changes schema seal or tenant row scope: stale certificate refuses; a `WideFieldMask` containing salary/secret fields cannot bypass row-level authorization or expose hidden explanation edges. + +## 8. Observer / ONA / Shannon focus without authority [H] + +Separate the subject graph **(source + policy)** from the software graph **(SAG prepared method/evidence)** and from a speculative observer's **attention state**. Never write observed facts simply because an inference appeared credible. Proposed optional experiment: + +```text +Missing/Contradictory Evidence (coverage gap, policy conflict, stale method) + -> rank read-only questions under budget (value of information) + -> select next source read / provenance query / dir_sim ablation + -> replay and compare resolved cases, cost and false alerts + -> create explanatory proposal and falsifiable test (not provider action) +``` + +Three independent measures: +1. data entropy/surprisal over observed attribute distributions; +2. epistemic uncertainty about claims given dependency-aware evidence; +3. operational severity/risk and effort (policy-grounded, not entropy-derived). + +**Conjecture:** a budgeted observer may reduce *unanswered* identity questions at lower query cost. Do not claim better identity decisions without an oracle. [arXiv:2602.16708](https://arxiv.org/abs/2602.16708) argues that agent policy enforcement must live outside prompts, using policy-relevant decision points and observability contracts; it is a reference proposal, not proof a deployed LG reference monitor exists. + +**IAM-30/31:** observer-on vs observer-off has identical effective role decisions for the same pinned data; adversarial retrieved notes or user-supplied code suggesting `execute()` never cross the capability boundary. + +## 9. Model-checking / metamorphic test grid + +In addition to IAM-01..15: + +| ID | Deliberately broken assumption | Expected falsification | +|---|---|---| +| 16 | incomplete page/scope looks closed | `Undetermined`, not `Absent` | +| 17 | UPN reassigned between people | no cross-person role carryover | +| 18 | alias/transitive uncertain anchors A≈B≈C | refuse accidental cross-tenant merge | +| 19 | alternate path survives mutation | entitlement still effective | +| 20 | missing proof of negation | cannot issue complete `why_not` | +| 21 | explicit deny alongside permit | versioned combining algorithm governs | +| 22 | role conflicts from two providers | SoD check detects effective conflict | +| 23 | JIT expiry / break-glass event | expired grant refused; session separately known | +| 24 | later policy extension | invalid/stability-qualified invariant certificate | +| 25 | SCIM conditional write conflict | version precondition stops effect | +| 26 | provider success followed by timeout | UnknownOutcome, re-observe before retry | +| 27 | compensation attempted after privilege session | does not claim revocation of session | +| 28 | compiler result reused after schema or actor-scope drift | certificate invalid | +| 29 | WideFieldMask selected private column | row/field authorization still controls visibility | +| 30 | ONA priority changed, observations fixed | factual/policy answer remains bit-identical | +| 31 | malicious note fakes approval | zero executable authority gained | +| 32 | evidence order/permutation changed | same versioned result and witness set | +| 33 | source observation replay duplicated | no extra evidence or duplicate licenses | +| 34 | same principal 1000 paths, cyclic nested groups | bounded deterministic closure; no combinatorial explosion | +| 35 | observed policy/HR time lag | no present authority from stale history | +| 36 | software graph `MayRequire` with no compiled body | never labelled deployed | +| 37 | no user-readable clearance for sensitive witness | redact/refuse explanation without changing decision | +| 38 | tenant filter removed from one relation join | cross-tenant test goes red | +| 39 | two simultaneous provisioning plans | conflict / idempotency gate; no double license | +| 40 | license source precedence and exchange recipient mismatch | preserve proved primary SMTP and existing license; unsupported mapping refuses | + +The reference evaluator must be **separate from the optimized implementation**, small and explicitly bounded, not a hidden general-purpose graph runtime. Define test generator seeds, exact source graphs, policy/version seals, expected status, completeness and whether each proof is one-witness or exhaustive. A disable-run counts only when the named test goes red and the original is restored. + +## 10. Proposed release train, with stop points + +- **P0 (no shipping):** decide formal status vocabulary, source coverage and policy versioning; independent oracles for grant and absence. Publish test vectors IAM-16..21. +- **P1:** read-only `dir_sim` role impact + witness scope, multi-source completeness receipt *as a sidecar*; no new runtime/registry. +- **P2:** canonical identity link evidence, partial observability and version vector; guard tenant/security scope at all joins. +- **P3:** legal multihop relation carrier when D-CMH-G1-4 unblocks, plus SoD/JIT graph projections; no live enforcement. +- **P4:** SAG certificate linkage, redacted explanation query and observer ablation; never produce authorize tokens from beliefs. +- **P5 (different PR, explicit review):** provider adapter contract, reference monitor, conditional writes, receipts and reconciliation; default read-only. Until then `do()` is inert. + +**Non-goals:** don't reinvent XACML, SCIM, OpenNARS, Hyperon, a general authorization PDP/PEP, a new R2IL opcode, tenant identity mint or directory writes. Treat identity security and privacy review as gating work, not an afterthought. + +## 11. Architectural falsification that can collapse the whole thesis + +If fully correct explanations of negative claims and policy decisions require a second independent authorization engine *because the current Quack/OGAR/dir_sim interface cannot legally express its proof obligation*, **stop** rather than hide a new runtime behind a hotplug. Document the smallest missing primitive, parity target, data/edge witness cost and authority boundary. That is an informative result. + +The high-signal hypothesis remains narrow: **the same SoA substrate can host independent typed readings of identity, policy, evidence and software methods**, while the meaning of those readings and the authority to act stay separately governed. \ No newline at end of file From 2ea0f7e9cf1fbbe6dfd49c55295c1d0efdb49a24 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:31:50 +0200 Subject: [PATCH 06/13] research(iam): distill why-not provenance, robust policy and agent gates --- ...e_authority_and_agentic_policy_excerpts.md | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 .arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md diff --git a/.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md b/.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md new file mode 100644 index 000000000..ecbaa5d86 --- /dev/null +++ b/.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md @@ -0,0 +1,100 @@ +# IAM negative provenance, robust policy and action gates: second research distillation + +> **2026-10-12 / source-aware design notebook, no implementation.** Companion to [D-IAM-SAG-1](../.claude/plans/iam-substrate-frontier-gaps-v1.md), [D-IAM-SAG-0](../.claude/plans/iam-substrate-sag-dir-sim-v1.md) and [the earlier primary excerpts](2026-10_iam_access_paths_temporal_provenance_primary_excerpts.md). +> +> **Method:** short *paraphrased* abstracts or named-section extracts; the publication may support a claim about its own formalism but does not prove a cross-system IAM implementation. Each entry explicitly labels **Source result [R]**, **LG transfer hypothesis [H]**, **test/falsifier**, and **non-transfer**. No long verbatim excerpts. The references were checked against the primary arXiv/OASIS/IETF landing pages. Newer arXiv material is a research proposal unless a cited evaluation establishes a narrower claim. + +## N1. Why *not* access? Provenance with negation + +**Primary:** Seokki Lee, Sven Koehler, Bertram Ludäscher, Boris Glavic (2017), *Efficiently Computing Provenance Graphs for Queries with Negation*, [arXiv:1701.05699](https://arxiv.org/abs/1701.05699), abstract, firing-rule technique and query-focused provenance computation. + +**Exzerpt [R], abstract (sinngemäß):** An explanation for a missing query result needs to account for derivations that fail, not only positive output tuples. The work rewrites Datalog rules to expose successful and unsuccessful derivations, handles negation, and prunes irrelevant portions of the provenance graph. Its evaluated implementation executes relationally in SQL. + +**LG hypothesis [H]:** Positive `RoleEvidence::Held` already has a concrete SID-chain witness. Negative `why_not_access` should require an explicit domain-closure certificate (which sources/groups/policies have been read) and a *failed derivation*, not just an empty bitmap. An authorized negative decision and an indeterminate read are different outputs. + +**Falsifier:** remove an unread source page that holds an alternative grant; `why_not_access` must stop claiming complete absence. Two equal negative results under different coverage must carry different provenance. **Non-transfer:** the paper does not claim that a directory oracle is closed-world or that arbitrary Cypher/Quack multi-hop negation already lowers. + +## N2. Robustness under future policy extension + +**Primary:** Alexander V. Gheorghiu (2026), *Verification of Robust Properties for Access Control Policies*, [arXiv:2603.13181](https://arxiv.org/abs/2603.13181), abstract, robust-support judgment and compositional proof theorem. + +**Exzerpt [R], abstract (sinngemäß):** Policies are often incomplete or assembled from components. The paper defines properties that remain guaranteed regardless of unspecified pending choices and later policy extensions, proves a monotonicity property for *that support judgment*, and reduces verification to a finite proof search in second-order logic programming. + +**LG hypothesis [H]:** An SoD rule proven at policy version p7 may or may not remain safe after external grants at p8. Store the assumptions and version constraints under which a certificate is robust; if the native policy language does not support this proof, invalidate its use after policy changes. + +**Falsifier:** add a second role grant from another provider after the approved snapshot. A point-in-time `no SoD conflict` proof must not remain valid unless its stated robustness assumptions are met. **Non-transfer:** the theorem does not assert that all enterprise policy combinations are monotone or that OGAR policy has implemented the paper's logic. + +## N3. External enforcement for agentic proposals + +**Primary:** Nils Palumbo et al. (2026), *Formal Policy Enforcement for Real-World Agentic Systems*, [arXiv:2602.16708](https://arxiv.org/abs/2602.16708), v3, abstract, policy-independent reference monitor and observability assumptions. + +**Exzerpt [R], abstract (sinngemäß):** Encoding permission rules solely in a language model prompt provides no formal guarantee. The authors describe a policy monitor over program execution context with an observability service, an assume/guarantee contract and Datalog rules, and evaluate several agentic use cases. Any formal guarantee is conditioned on the environment contract. + +**LG hypothesis [H]:** ONA/Hyperon-inspired introspection can rank read-only identity questions and generate proposals; *permission to mutate* must instead come from an external actor/scope/capability gate with a fresh source/policy precondition. Prompt text, SAG tier and a derived truth score never mint authority. + +**Falsifier:** feed the observer a forged administrator note, an apparent `Tier::Verified` dependency and a stale approval; run identical query data. No provider-capable action should be reachable. **Non-transfer:** citing FORGE does not mean LG already has a reference monitor or Datalog interpreter. + +## N4. Policy conflict resolution is specific, typed and often indeterminate + +**Primary standard:** OASIS (2013), *eXtensible Access Control Markup Language (XACML) Version 3.0*, [OASIS Standard](https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html); policy/rule-combining algorithms, decision types and obligations. + +**Exzerpt [R], combining algorithms (sinngemäß):** Deny-overrides prioritizes Deny under defined precedence rules; permit-overrides, first-applicable and only-one-applicable differ. NotApplicable and different kinds of Indeterminate cannot be replaced by a Boolean “no grant”. + +**LG hypothesis [H]:** An IAM graph may *project* `PolicyEvaluation{Permit,Deny,NotApplicable,Indeterminate}` with the versioned declared combining algorithm and obligation status. It must not “invent” a universal deny-overrides rule. This is a read-only semantic adapter, not production XACML enforcement. + +**Falsifier:** one positive group role path + explicit deny, then switch the *declared* combining algorithm and test the expected (possibly indeterminate) outcomes against a reference evaluator. Missing condition must not turn into `Permit`. **Non-transfer:** an enterprise IdP need not use XACML semantics even if graph policy looks similar. + +## N5. SCIM is an interoperability protocol, not a distributed transaction + +**Primary standards:** IETF [RFC 7643](https://www.rfc-editor.org/info/rfc7643) (SCIM core resource schema); [RFC 7644](https://www.rfc-editor.org/info/rfc7644) (SCIM protocol), specifically §§3.5.2, 3.14, 4 and the Bulk section. + +**Exzerpt [R], RFC 7644 (sinngemäß):** SCIM supports conditional updates using ETags where offered, PATCH with atomic semantics for the *single resource request*, and service-provider configuration discovery. The specification does not make writes across independent directories and SaaS products one ACID transaction. + +**LG hypothesis [H]:** a future action connector needs capability discovery, source version/ETag, a purpose-scoped approval, provider idempotency semantics, and a receipt. If a provider returns timeout with uncertain effect, do not immediately repeat a destructive request or claim failure; re-observe. + +**Falsifier:** issue a synthetic duplicate request after a simulated post-success timeout, verify only one intent is reconciled; stale If-Match refuses. **Non-transfer:** SCIM read/write features may be unsupported by an individual provider. Not every AD/Graph/PowerShell endpoint is SCIM. + +## N6. Pre-commit policy conflicts and emergency access are domain-specific + +**Primary:** Nasif Muslim, Jean-Charles Grégoire (2026), *An Extended Consent-Based Access Control Framework: Pre-Commit Validation and Emergency Access*, [arXiv:2603.07004](https://arxiv.org/abs/2603.07004), abstract, pre-commit conflict checking and emergency disclosure constraints. + +**Exzerpt [R], abstract (sinngemäß):** In a healthcare consent setting, the authors propose checking contradictory permissions *before activation* and constrain emergency access using context-sensitive evidence. Reported experiments use controlled synthetic workloads. This is a narrow domain design, not a universal break-glass algorithm. + +**LG hypothesis [H]:** simulate privileged activation and SoD-policy conflicts before a change is made; preserve separate emergency *reason*, human approval, valid interval and session evidence. Emergency access must never arise simply because a reasoning model estimates high urgency. + +**Falsifier:** proposed emergency role with no declared break-glass authority is refused; a valid but expired emergency grant remains non-executable. **Non-transfer:** no health-data or emergency semantics are part of standard OGAR IAM policy unless explicitly imported. + +## N7. Prior provenance complexity remains a release gate + +**Primary:** Marco Calautti et al. (2023), *The Complexity of Why-Provenance for Datalog Queries*, [arXiv:2303.12773](https://arxiv.org/abs/2303.12773), abstract and complexity results; also detailed in the first IAM excerpts. + +**Exzerpt [R], abstract (sinngemäß):** Computing witnesses for recursive Datalog why-provenance is intractable in some studied cases, whereas nonrecursive cases are substantially more tractable. Practical SAT-based experiments are reported. + +**LG hypothesis [H]:** witness search must expose a budget, whether a result is one-path/exhaustive, and the size of the claimed source closure. Negative access explanations and minimal interventions require stronger claims than a single positive witness. + +**Falsifier:** thousands of overlapping grant paths plus a group cycle, with a fixed query budget: refusal/incomplete result is allowed, silent false “no access” is not. **Non-transfer:** no automatic performance result for Quack, nor a proof that each IAM graph instance requires SAT. + +## N8. Existing reference on evidence independence + +**Primary:** Audun Jøsang (2007), *Cumulative and Averaging Fission of Beliefs*, [arXiv:0712.1182](https://arxiv.org/abs/0712.1182), fusion/fission sections. Prior extract: [NARS evidence notes](2026-10_nars_self_epistemic_needs_evidence_primary_excerpts.md). + +**Exzerpt [R] (sinngemäß):** dependent observations require different fusion from independent observations; removal of a known contributor can require original evidence and preconditions. The formalism is Subjective Logic, not automatically NARS. + +**LG hypothesis [H]:** one HR event relayed through AD and Entra is one upstream *event*, not three independent confirmations. Separate the observation receipt from its derivations; when simulating ablation, remove the upstream contribution and recompute downstream effects at one pinned version. + +**Falsifier:** replicate the same HR event through two adapters, replay both, and verify that license evidence does not gain an artificial second source. A fully independent event may contribute separately. **Non-transfer:** the current F/C register does not encode all dependency information needed for exact fission. + +## Synthesis / decision map + +| Research result | Immediate safe reuse | Need to build | Never infer | +|---|---|---|---| +| Negation/why-not provenance | `dir_sim::RoleEvidence`'s explicit Undetermined | source-scope closure and failed-derivation receipt | missing edge = denial | +| Robust properties | versioned policy tests | certificate assumptions and policy-extension invalidation | all policies monotone | +| Agentic reference monitor | independent `do()` boundary | provider authorization and effect receipts (later PR) | SAG confidence authorizes action | +| XACML decision algebra | explicit evaluation outcome types | binding of declared policy-combining semantics | universal deny-overrides | +| SCIM ETag and PATCH | provider contract checklist | read-only capability discovery before any future write | cross-system atomicity | +| Pre-commit conflict checking | `dir_sim` what-if simulation | SoD/JIT policy rule projection | emergency inference is permission | +| Recursive provenance | bounded witnesses and explicit completeness | legal Quack relation carrier/parity | one path is full explanation | +| Dependent evidence | source receipts and delta lineage | evidence ancestor equivalence semantics | two adapters = two independent facts | + +**Priority:** start with negative-proof completeness and multi-source identity/temporal provenance in a *read-only* follow-on, not a new engine or a DO integration. This literature supports sharper falsifiers; it does not certify implementation. From 70c56418924652312a62ed55adf41a4baa084d41 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:32:16 +0200 Subject: [PATCH 07/13] docs(iam): link frontier proof and authority research from base RFC --- .claude/plans/iam-substrate-sag-dir-sim-v1.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.claude/plans/iam-substrate-sag-dir-sim-v1.md b/.claude/plans/iam-substrate-sag-dir-sim-v1.md index c269b9c53..77b588e6c 100644 --- a/.claude/plans/iam-substrate-sag-dir-sim-v1.md +++ b/.claude/plans/iam-substrate-sag-dir-sim-v1.md @@ -168,3 +168,18 @@ See [primary-source excerpts](../../.arxiv/2026-10_iam_access_paths_temporal_pro - IAM-01..15 test matrix with disable/falsification evidence; one passing end-to-end `explain -> simulate -> re-evaluate -> propose` demo. - Measurement table (baseline, candidate, environment, versions) before any performance claim. - Security review showing external provider writes impossible in read-only mode; no unreviewed policy/byte-layout/ISA drift. + +## 11. Frontier expansion after the first draft: deliberately **not** a shipped capability + +**Follow-on RFC:** [D-IAM-SAG-1: negative proof, temporal authority, safe introspection](iam-substrate-frontier-gaps-v1.md) and its [source-distilled excerpts](../../.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md). The [Claude Code handoff](../prompts/iam-substrate-after-1509.md) now carries the additional research and falsification obligations. + +The first 15 tests primarily cover *positive* entitlement evidence and directory what-if. The extension adds IAM-16..40, grouped by proof obligation: + +- **Proof of absence:** complete source/policy coverage, failed derivations, witness exhaustiveness and alternate paths. A shortest path is not a sufficient revocation proof. +- **Proof of identity and time:** verified cross-tenant anchors, source GUID distinct from DN, source/policy version vectors, observation-vs-valid-vs-record-vs-execution times. +- **Proof of policy:** versioned decision-combining algorithm, explicit Permit/Deny/NotApplicable/Indeterminate, SoD/JIT/approval expiry, bounded negative explanation. +- **Proof of action:** actor-scoped independent authorization, fresh provider preconditions, idempotency/unknown-outcome receipts, provider-specific compensation, no automatic rollback guarantee. +- **Proof of introspection:** SAG compiled vs verified tiers, actor row scope independently checked from WideFieldMask, ONA/Hyperon observer evaluated by no-observer ablation with no authority transfer. +- **Proof of responsible explanation:** tenant-scoped/redacted witness output, machine identities, duplicate-source lineage, adversarial prompt injection and cyclic/high-path-count workloads. + +**Release order:** maintain W0/W1 as the smallest read-only implementation. Research the expanded test fixture now; implement only when its domain's existing semantics and compiled oracle can be verified. General multi-hop, policy evaluator and provider DO remain independent later work. These are *candidate requirements*, not claims of new Rust code or completed review. From c716502ead40ce69ee5773513e81257942f5230b Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:33:03 +0200 Subject: [PATCH 08/13] docs(iam): extend Claude handoff with absence, time and authority falsifiers --- .claude/prompts/iam-substrate-after-1509.md | 75 +++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/.claude/prompts/iam-substrate-after-1509.md b/.claude/prompts/iam-substrate-after-1509.md index 99bc88104..1dfab18f3 100644 --- a/.claude/prompts/iam-substrate-after-1509.md +++ b/.claude/prompts/iam-substrate-after-1509.md @@ -68,3 +68,78 @@ Deliver: 7. An **OPEN questions** table where data is unavailable; do not replace missing evidence with inference. **Definition of done:** one well-specified, tested, read-only IAM access-path/impact claim and SAG-aware method evidence, with no second engine and no unproved external authority. If it cannot compile legally, deliver an explicit, code-grounded blocker instead of a fake implementation. + +## Research extension D-IAM-SAG-1 (required reading, not new scope authorization) + +The original task intentionally focused on the positive role path. Also read, before implementing a general IAM policy surface: + +- [Frontier architecture addendum](../plans/iam-substrate-frontier-gaps-v1.md), with a decision/authority/time ontology, release train and IAM-16..40; +- [Why-not provenance, robust access policies and agentic reference monitors](../../.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md), with original arXiv/OASIS/IETF sources, transfer limits and falsifiers. + +**The extension does not enlarge the first implementation slice.** If this prompt is used for the first Rust PR, implement only a smallest read-only, test-pinned path; mark the remaining requirements open. The extensions guard against accidentally shipping a positive-graph demo as a full IAM policy engine. + +### X1. Answer types and data completeness + +Design or evaluate (do not prematurely expose a new contract API) **three distinct result planes**: + +1. Evidence: positive witness, complete scoped absence, incomplete/unknown or contradictory sources; +2. Policy: Permit, Deny, NotApplicable, Indeterminate (including the *explicitly selected* policy-combining algorithm); +3. Provider: actual accepted/rejected/no observation, which the graph must never infer from a permission edge. + +Extend the original synthetic fixture with a missing page, incomplete group-policy read, explicit empty policy, explicit deny, and a changed combining algorithm. Show **which authority** was read and why the negative conclusion does or does not follow. A closed-world claim must cite its complete source scope and versions. Do not collapse absent evidence, unknownness and Deny into false. + +### X2. Multi-path, negation and bounded completeness + +- Produce two independent granting paths, remove only one, and verify the entitlement remains. Use `RoleImpact::between` for directory role impact; do not equate its one shortest path with exhaustive reachability. +- Record `one_witness / exhaustive / incomplete_due_to_budget` on every explanation. Explicitly refuse a universal “no access” claim where source coverage is incomplete or path enumeration is bounded. +- Include `why_not_access` fixture; test against a **separate small reference model**. Do not silently implement Datalog/XACML/provenance as a second production engine. +- A minimal set of membership removals is not automatically the lowest-risk or authorized intervention. Include business-policy constraints in the simulation oracle. + +### X3. Source identity and four time concepts + +- Verify source AD GUID, Entra objectId, SCIM id, canonical NodeGuid, full classid, mutable DN, user alias, tenant and SIDHistory are separate unless a **reviewed and versioned** mapping explicitly links them. +- Test UPN reuse, two forests with same sAMAccountName, one-to-many sync anchor ambiguity, and a service/workload principal with no human HR record. No privilege inheritance from probabilistic matching. +- Report effective-at, observed-at, recorded-at, and decision/execution-at separately; use a **version vector** for AD/Entra/HR/MDM/policy rather than pretending `VersionStore::VersionId` is a cross-provider transaction. +- Under source clock skew, partial snapshots or changed policy revision, either refuse a consistency-sensitive claim or explicitly downgrade it. Historical permission never yields present write permission. + +### X4. Lifecycle, SoD and JIT as policy problems + +Use synthetic examples for: moved employee with a temporary double entitlement, leaver with a stale app session, mutually exclusive roles from two sources, orphaned automation principal, privileged JIT grant that expires, break-glass requiring a separate approval. Refuse a “verified safe” claim when versioned policy constraints are unavailable. Treat robust-under-future-policy-extensions as a research problem, not an achieved theorem. + +### X5. Independent executable authority and protocol receipts + +No actual provider writes are allowed in this PR. For future protocol contracts, specify: +```text +proposed != approved != requested != applied != re-observed != verified +``` +A provider timeout may mean success or failure: **UnknownOutcome**, re-observe before retry. If conditional resource versions/ETags are unsupported, fail safely or explicitly require a different authorized concurrency strategy. SCIM per-resource PATCH atomicity is not cross-provider rollback. Do not let a natural-language prompt, SAG `Tier::Verified`, a CE64 confidence code or a speculative CARE/ONA observer supply authorization. Do not imply revoking a group membership terminates an already issued privileged session. + +### X6. Negative-proof privacy and information flow + +The answer `why does Anna have access?` can expose privileged group and policy names. Include a principal/tenant/scope-bound explanation gate, field redaction and completeness labeling. A request may legitimately obtain the policy decision but **not** all witness edges. Redaction must not change the underlying decision, and graph traversal must not cross tenant scope. `WideFieldMask` is a projection, not an authorization decision. + +### X7. Property-based/metamorphic and disable-run suite + +Track IAM-16..40 from the frontier plan. Essential metamorphic checks: +- Source-row order and graph-edge order permutation do not alter effective answers. +- Replaying one upstream event from two adapters does not double-count license or evidential confirmation. +- Adding an independent allow path cannot remove a role grant **under a declared purely positive graph rule**, but this monotonicity must NOT be generalized to deny rules or mutable policies. +- Alternative grant path removal must not imply entitlement loss. +- A source policy version change invalidates a stale certificate if the rule is not proved robust under the permitted extension. +- Actor row-scope, field authorization, source coverage and executable-effect gates each have a named disable-red test. +- Cyclic 1000-path fixture has a stated cost/time/memory bound and returns `incomplete` rather than a false exhaustive proof. +- Observer/no-observer with identical inputs produces identical authorized results, even if query cost and discovery order change. + +**Stop sign:** If a capability requires inventing a second policy evaluator, traversal runtime or authority registry to make tests pass, STOP and write an explicit blocker and narrow follow-on PR. Don't mislabel inferred behavior as compiled/verified. + +### X8. Handoff output expansion + +In addition to the earlier deliverables, report: +- an access-decision/evidence/provider triple for each fixture, including unknown cases; +- exact completeness scope and source/policy version vector; +- one-witness vs exhaustive explanation with witness budget; +- a source-anchor collision ledger and privacy review; +- result parity and disable evidence, including IAM-16..40 as Pass/Fail/Blocked/Not attempted with **no fabricated green**; +- what remains research-only, what is code-grounded, and what would require new authority/legal/security review. + +**Ultimate invariant:** graph inference may *propose* a safe action, but it cannot *become* the principal that authorizes it. From f083bbc8016297d3ac7a4f6c3978f95c9446ccb3 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:33:25 +0200 Subject: [PATCH 09/13] docs(board): register D-IAM-SAG-1 research and falsification gates --- .../2026-10-12-iam-substrate-sag-dir-sim.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md index 85b7fb244..156e9047e 100644 --- a/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md +++ b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md @@ -30,3 +30,22 @@ Treat IGA, PAM, access/SSO, directories, device/app and automation as **overlapp **Principal boundaries:** observed ≠ inferred ≠ authorized; one provenance witness ≠ exhaustive proof; group membership ≠ successful SSO; simulated role impact ≠ executed revocation; append-log version ≠ observation/policy effective time. No new ISA bit reading or CE64 mutation. **Implementation expectation:** execute [the prompt](../../prompts/iam-substrate-after-1509.md) against actual code, ship narrow test-pinned W1/W2 first, and leave unfinished integration explicitly open. + +## Frontier addendum D-IAM-SAG-1, research-only (2026-10-12) + +**New plan:** [iam-substrate-frontier-gaps-v1](../../plans/iam-substrate-frontier-gaps-v1.md). **New excerpts:** [iam-negative-provenance-authority](../../../.arxiv/2026-10_iam_negative_provenance_authority_and_agentic_policy_excerpts.md). **Same expanded prompt:** [iam-substrate-after-1509](../../prompts/iam-substrate-after-1509.md). + +| D-id | Additional proof obligation | Status / falsifier | +|---|---|---| +| D-IAM-SAG-1-0 | Closed-world scope and why-not provenance | RFC; IAM-16,19..21 | +| D-IAM-SAG-1-1 | Source-specific identity anchors and version vectors | RFC; IAM-17,18,35,38 | +| D-IAM-SAG-1-2 | Deny/Permit/NotApplicable/Indeterminate and policy precedence | RFC; IAM-21..24 | +| D-IAM-SAG-1-3 | Alternate-witness, multi-cut, SoD/JIT and temporal what-if | RFC; IAM-19,22..24,34 | +| D-IAM-SAG-1-4 | Independent effects authority, receipts and unknown outcomes | Research-only, **separate implementation PR**; IAM-25..27,39 | +| D-IAM-SAG-1-5 | SAG method certificates, field+row privacy boundary | RFC; IAM-28,29,36..38 | +| D-IAM-SAG-1-6 | Observer/no-observer ablation and independent safety gate | RFC; IAM-30,31,33 | +| D-IAM-SAG-1-7 | License reconciliation and edge-order invariance | RFC; IAM-32,33,39,40 | + +**Numbered falsifiers:** IAM-01..15 remain the first-draft baseline; IAM-16..40 are planned, not run. The addendum contains 25 additional cases, including adversarial/disable controls. Source research includes [arXiv:1701.05699](https://arxiv.org/abs/1701.05699), [arXiv:2603.13181](https://arxiv.org/abs/2603.13181), [arXiv:2602.16708](https://arxiv.org/abs/2602.16708), [arXiv:2603.07004](https://arxiv.org/abs/2603.07004), [OASIS XACML 3.0](https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html) and [RFC 7644](https://www.rfc-editor.org/info/rfc7644). + +**Scope invariant:** no new compiler opcode, graph engine, policy authority, register-lane/CE64 encoding, live provider write, privileged session, or claim of implemented validation. Integrate only by a later code-grounded, reviewable PR. From 7d7bea407bdd05751c32706a501c909c6282ad6a Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:35:40 +0200 Subject: [PATCH 10/13] docs(iam): reconcile merged #1514 carrier and proposed Intune/GPO policy seam --- .../plans/iam-substrate-frontier-gaps-v1.md | 38 ++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/.claude/plans/iam-substrate-frontier-gaps-v1.md b/.claude/plans/iam-substrate-frontier-gaps-v1.md index 6ab64fe19..14790f6cf 100644 --- a/.claude/plans/iam-substrate-frontier-gaps-v1.md +++ b/.claude/plans/iam-substrate-frontier-gaps-v1.md @@ -240,4 +240,40 @@ The reference evaluator must be **separate from the optimized implementation**, If fully correct explanations of negative claims and policy decisions require a second independent authorization engine *because the current Quack/OGAR/dir_sim interface cannot legally express its proof obligation*, **stop** rather than hide a new runtime behind a hotplug. Document the smallest missing primitive, parity target, data/edge witness cost and authority boundary. That is an informative result. -The high-signal hypothesis remains narrow: **the same SoA substrate can host independent typed readings of identity, policy, evidence and software methods**, while the meaning of those readings and the authority to act stay separately governed. \ No newline at end of file +The high-signal hypothesis remains narrow: **the same SoA substrate can host independent typed readings of identity, policy, evidence and software methods**, while the meaning of those readings and the authority to act stay separately governed. + +## 12. Post-#1509 implementation drift: #1514 earns *one* relation hop [G, on main] + +**Verified after writing this RFC:** [#1514](https://github.com/AdaWorldAPI/lance-graph/pull/1514) is merged to `main` (the #1512 research branch was cut at the earlier #1509 merge and has not been rebased). `crates/lance-graph-glove-parity/tests/relation.rs` and `src/gremlin.rs` now expose **D-CMH-G1-4a**, a *functional* `out(rel)` carrier preserving one anchor row per traverser. A declared `Relation` uses a foreign key; `out(rel)` tests that it references a **live** target with `Filter::Semijoin`; `out(rel).has` can evaluate `EqU32Via`. The tests use synthetic ERP line->partner rows n=1,64,65,4097 with text-based row oracles and documented disable runs. + +**Exactly what it does NOT earn:** +- fan-out or many-to-many access membership, `in`/`both`, or target dedup; +- a second hop `out(rel).out(rel)` (explicit `SecondHop` refusal); +- sums/values or referenced methods after a relation when the method glove refuses them; +- R2IL parity for the foreign-target liveness test: R2IL's current fold band lacks `GATHER`, and the method reports `FrontendGap`; +- a complete IAM authorization result, policy evaluation, source identity merge or production session evidence. + +**IAM transfer [H]:** a functional `User -> Manager` or `Line -> Account` read could reuse this exact carrier, but `User -> Groups -> Roles -> Entitlements` is multi-valued and recursive. It cannot use `out(rel)` without proving multiplicity and anchor semantics. This **updates** earlier #1509-era text that described *all* relation carriers as absent. The general D-SAG-1-4 and D-CMH-G1-4 obligations are still open. + +**IAM-44:** a synthetic functional one-hop matches #1514's row oracle and refuses an R2IL path that needs `GATHER`. **IAM-45:** a user with two groups and cyclic/nested memberships must not be silently forced into a one-foreign-key functional relation; fan-out/second-hop deliberately refuse pending an earned carrier. + +## 13. Device policy is not device compliance: D-PBL intersection [P, on main] + +The [policy-baseline integration plan](policy-baseline-integration-v1.md) is a **proposal** on current `main`, not an implemented Intune/GPO reader. It distinguishes: + +| Layer | GPO | Intune | +|---|---|---| +| Configured | directory policy object + SYSVOL setting | Graph configuration setting | +| Assigned | GPO link, inheritance, security/WMI filter | target group, exclusion and assignment | +| Observed | only via supplied client-side RSoP/status (not centrally inferred) | per-device status returned by Intune | +| Authorization consequence | only if a **separate** supported access-control policy uses the fact | only if conditional-access policy and evaluation evidence authorize the effect | + +A unified policy-setting row needs published **GPO↔CSP mapping evidence**; identical-looking names and values are not proof of the same setting. An unmapped setting remains source-specific. `dir_sim` cannot assume it already contains device populations: D-PBL explicitly identifies device ingestion, device-group path support and read-only source adapters as gaps. + +**IAM-41:** assignment to a group with an explicit exclusion is not applied to excluded device; missing device/group reader yields `Unknown`, not compliance. + +**IAM-42:** `GPO configured=true` plus link is not the same as `observed compliant`; without RSoP/device evidence, observed GPO state remains unknown. + +**IAM-43:** unreviewed GPO↔CSP alias/mapping and a missing device object must fail closed on cross-source policy comparison. A device policy conflict may be *observed* without automatically deciding conditional access. + +**Dependency:** D-PBL must separately earn policy-object ingestion, source mapping, assignment precedence and actual device status before the IAM projection can consume it. Do not move GPO/Intune into `dir_sim` as if they shared directory authority or write lifecycle. This new seam is relevant to the advertisement's “Device & App Management” category, but it is not proof of an Intune connector. From f74cb7162f0994a1b18050cfc032d9adf6381437 Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:35:57 +0200 Subject: [PATCH 11/13] docs(prompt): add current #1514 and Intune/GPO seam tests --- .claude/prompts/iam-substrate-after-1509.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.claude/prompts/iam-substrate-after-1509.md b/.claude/prompts/iam-substrate-after-1509.md index 1dfab18f3..e516a803a 100644 --- a/.claude/prompts/iam-substrate-after-1509.md +++ b/.claude/prompts/iam-substrate-after-1509.md @@ -143,3 +143,14 @@ In addition to the earlier deliverables, report: - what remains research-only, what is code-grounded, and what would require new authority/legal/security review. **Ultimate invariant:** graph inference may *propose* a safe action, but it cannot *become* the principal that authorizes it. + +### X9. Refresh the baseline for #1514 and the D-PBL device policy proposal + +Before doing any traversal work, inspect merged [#1514](https://github.com/AdaWorldAPI/lance-graph/pull/1514), `crates/lance-graph-glove-parity/{src/gremlin.rs,tests/relation.rs}` on current main and [the frontier update](../plans/iam-substrate-frontier-gaps-v1.md#12-post-1509-implementation-drift-1514-earns-one-relation-hop-g-on-main). Correct older “no relation carrier” statements: + +- **Available on main:** one functional FK `out(rel)`, liveness via `Semijoin`, filtered target property via `EqU32Via`, anchor preserved, tested in Quack/mask-risc on a synthetic ERP fixture. +- **Still missing:** general many-to-many group memberships/fan-out, `out().out()`, target `values`/sum/dedup, R2IL `GATHER` parity, multi-hop SAG queries. Do not retrofit IAM's recursive group closure into a functional FK without independently proving multiplicity semantics. +- **D-PBL-0..7** in `.claude/plans/policy-baseline-integration-v1.md` is proposal only: GPO configured vs assigned vs observed differs from Intune configured vs assigned vs per-device observed; D-PBL explicitly lacks device ingestion and canonical GPO↔CSP mapping unless sourced. No “compliant” result from an assigned policy alone. +- **New gates IAM-41..45** in frontier plan check Intune exclusions and unknown device membership, GPO observed unknown without RSoP, unmapped policy-setting identity, one-hop Quack/R2IL asymmetry, and rejection of false functional cardinality. + +Report the current SHA and whether #1514 has landed in the implementation checkout. This research PR branch is intentionally still based on #1509; implementations should start from the then-current main or explicitly rebase before testing. Stop if a baseline assertion cannot be reconciled with code. From 54a7c3a02f4c3245a2b282b4a637c03cf701b3be Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:36:19 +0200 Subject: [PATCH 12/13] docs(iam): note #1514 and device-policy baseline drift --- .claude/plans/iam-substrate-sag-dir-sim-v1.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.claude/plans/iam-substrate-sag-dir-sim-v1.md b/.claude/plans/iam-substrate-sag-dir-sim-v1.md index 77b588e6c..7c1f84467 100644 --- a/.claude/plans/iam-substrate-sag-dir-sim-v1.md +++ b/.claude/plans/iam-substrate-sag-dir-sim-v1.md @@ -183,3 +183,7 @@ The first 15 tests primarily cover *positive* entitlement evidence and directory - **Proof of responsible explanation:** tenant-scoped/redacted witness output, machine identities, duplicate-source lineage, adversarial prompt injection and cyclic/high-path-count workloads. **Release order:** maintain W0/W1 as the smallest read-only implementation. Research the expanded test fixture now; implement only when its domain's existing semantics and compiled oracle can be verified. General multi-hop, policy evaluator and provider DO remain independent later work. These are *candidate requirements*, not claims of new Rust code or completed review. + +### Implementation drift observed after #1509 + +Current `main` has merged [#1514](https://github.com/AdaWorldAPI/lance-graph/pull/1514): **one functional foreign-key `out(rel)`** with `Semijoin` liveness and `EqU32Via` in the glove parity method layer. This is real progress beyond #1509, but IAM's many-to-many group membership, second hop and R2IL `GATHER` parity remain unsolved. The updated [frontier addendum](iam-substrate-frontier-gaps-v1.md#12-post-1509-implementation-drift-1514-earns-one-relation-hop-g-on-main) identifies the precise boundary. It also connects the new [D-PBL GPO/Intune policy baseline proposal](policy-baseline-integration-v1.md) to IAM without conflating configured/assigned/observed state or claiming the Intune connector exists. With IAM-41..45, the full proposed test catalog is **IAM-01..45**, not 40; none is executed by this documentation PR. The #1512 branch remains anchored at #1509 and is behind main pending a later synchronization. From 65cf45dc78e9dd46713efb30ad3a509102f29d4d Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Mon, 12 Oct 2026 21:36:21 +0200 Subject: [PATCH 13/13] docs(iam): note #1514 and device-policy baseline drift --- .claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md index 156e9047e..29cc991d0 100644 --- a/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md +++ b/.claude/board/entries/2026-10-12-iam-substrate-sag-dir-sim.md @@ -49,3 +49,7 @@ Treat IGA, PAM, access/SSO, directories, device/app and automation as **overlapp **Numbered falsifiers:** IAM-01..15 remain the first-draft baseline; IAM-16..40 are planned, not run. The addendum contains 25 additional cases, including adversarial/disable controls. Source research includes [arXiv:1701.05699](https://arxiv.org/abs/1701.05699), [arXiv:2603.13181](https://arxiv.org/abs/2603.13181), [arXiv:2602.16708](https://arxiv.org/abs/2602.16708), [arXiv:2603.07004](https://arxiv.org/abs/2603.07004), [OASIS XACML 3.0](https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html) and [RFC 7644](https://www.rfc-editor.org/info/rfc7644). **Scope invariant:** no new compiler opcode, graph engine, policy authority, register-lane/CE64 encoding, live provider write, privileged session, or claim of implemented validation. Integrate only by a later code-grounded, reviewable PR. + +### Post-#1509 drift note (main vs this research branch) + +Merged [#1514](https://github.com/AdaWorldAPI/lance-graph/pull/1514) provides D-CMH-G1-4a functional one-hop in the glove; general many-to-many, second hop and R2IL GATHER parity remain refused. On main, `.claude/plans/policy-baseline-integration-v1.md` is a proposal separating GPO/Intune configured, assigned and observed status. Neither is present as a tested IAM end-to-end feature in this research PR. **Additional tests IAM-41..45** cover device state/mapping and the exact one-hop boundary. Total planned falsifiers: **45**, all still unexecuted in this docs-only PR. See [frontier plan §§12-13](../../plans/iam-substrate-frontier-gaps-v1.md).