Reference Application 0.1.0-alpha.5

0.1.0-alpha.5 completes walkthrough Step 5: Govern Endpoints. The Step 4 governance rules now protect real application endpoints, which are evaluated before their actions run.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

What changed

Governed sample API

/api/v1/governed-operations demonstrates governance on application endpoints:

Endpoint	Governance	Result
GET /api/v1/governed-operations	None; explicitly anonymous	Read-only description
POST …/administrator	Administrator rule	Runs for an administrator; anyone else gets 403
POST …/capability	Capability rule and a required capability grant	Runs for an actor holding the grant; anyone else gets 403
POST …/consequential	Administrator, capability, and acknowledgment requirements	An administrator holding the grant receives a 428 acknowledgment challenge; the action does not run in Step 5

Every POST requires an authenticated user, a valid antiforgery token, and governance approval. Governance adds a boundary; it doesn't replace authorization or antiforgery protection.

Capability grants

ClaimEndpointCapabilityGrantValidator checks each scope an endpoint declares against the actor's normalized application:permission claims on authenticated identities. Declaring a scope on an endpoint never proves that the actor holds it.

Problem Details for denials

Governance denials return a safe HTTP 403 Problem Details response with the application's usual trace and request correlation fields, without exposing policy internals.

Tests

The suite now has 512 tests. New end-to-end and unit tests cover:

• each endpoint's allow and deny paths;
• the acknowledgment challenge;
• combined administrator-and-capability requirements on the consequential endpoint;
• anonymous rejection by authorization;
• antiforgery enforcement;
• the validator's handling of unauthenticated identities and acknowledgment-required decisions.

AsiBackbone 7.2.1: capability before acknowledgment

This release uses AsiBackbone 7.2.1. That version validates capability grants for every governance decision that is not already denied (AsiBackbone/AsiBackbone#887). On the consequential endpoint, an administrator without the capability grant is therefore denied with 403 rather than offered an acknowledgment challenge.

On AsiBackbone 7.2.0, the framework skipped capability validation for acknowledgment-required decisions and returned a 428 challenge instead. A test now asserts the denial, including that no acknowledgment handshake is issued (#17).

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (v0.1.0-alpha.4)
5. Govern endpoints	Complete (this release)
6. Persist and verify audit evidence	Planned

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.5+<commit>.

Changes

• Govern application endpoints and complete walkthrough Step 5 (#18).
• Update AsiBackbone to 7.2.1 so a missing capability grant is denied before any acknowledgment challenge (#19).
• Record the 7.2.1 update in the 0.1.0-alpha.5 changelog entry (#20).

Full changelog: v0.1.0-alpha.4...v0.1.0-alpha.5