Epic: Identity & Access Strategy — workforce build

[gangster]

North-star: docs/architecture/identity-and-access-strategy.md — the workforce-first identity & access strategy.

Build the unified model in phases: decide a principal's access once (who × what-they're-on × policy) → derive → project into every system from one git source of truth (gitops/teams + new gitops/people + Grants). Everyday access is standing; dangerous power is borrowed temporarily; auth strength scales with role; the scale-hardening (strategy §3) is owned honestly.

Phase 1 — the foundation (build now)

Build order: MFA first, then the registry → catalog → {both generators} → templates.

• Identity P1.5: Auth-strength — phishing-resistant MFA + step-up (Keycloak) #885 — P1.5 Auth-strength: phishing-resistant MFA + step-up (do first; independent of the roster)
• Identity P1.1: People registry — gitops/people/ schema + gate #886 — P1.1 People registry: gitops/people/ schema + gate
• Identity P1.2: Workforce role catalog (reach × power roles as artifacts) #887 — P1.2 Workforce role catalog (reach × power roles → permission sets + Keycloak roles)
• Identity P1.3: Identity Center generator — AWS console access from the registries #888 — P1.3 Identity Center generator: AWS console access from the registries
• Identity P1.4: Keycloak generator — app access from the People roster #889 — P1.4 Keycloak generator: app access from the roster (retire seed-users)
• Identity P1.6: Backstage "manage people" templates (propose-via-PR) #890 — P1.6 Backstage "manage people" templates (propose-via-PR)

Later

• P2 GitHub org-team membership connector · P3 temporary-power front door + emergency revocation · P4 PagerDuty/Slack connectors + live on-call · scale-hardening tracker (drift detection · access reviews · governance observability).

Builds on / dedup (link, don't duplicate)

• Access-model core (ADR-068 P4): P4 (ADR-068): Product-scoped & cross-team access model #361 P4.1 (ADR-068): AccessGrant CRD + cluster projection #362 P4.2 (ADR-068): Access-model-as-code — Product roles in Keycloak #363 P4.3 (ADR-068): OIDC-native developer cluster auth (EKS OIDC IdP) #364 P4.4 (ADR-068): Fan-out — ArgoCD RBAC + Backstage permissions from product roles #365 P4.6 (ADR-068): team-admin governance + grant lifecycle (request/TTL/re-attest) #367 P4.7 (ADR-068): Two-plane grant enforcement (access-grant-gate CI + Kyverno) #368 — re-parented under this epic.
• P4.3 (ADR-068): OIDC-native developer cluster auth (EKS OIDC IdP) #364 (OIDC-native cluster auth) is what resolves the Per-team DeveloperAccess role + EKS access entry not provisioned by the Environment Composition (v3 regression) #647 DeveloperAccess regression — that's per-team cluster (kubectl) access, a separate plane from the Identity Center console access this epic's generator builds.
• Machine/agent plane: ADR-074 enforcement + ADR-086 (graduated autonomy) — see Agentic Workloads (Epic: conversational resource agent (ADR-073 Phase B) #554).

CIAM (customer/end-user identity) is a named, deliberately-deferred plane.

[gangster]

Locked design decisions (2026-06-27)

Four Phase-1 open questions resolved before build:

Q1 — Role catalog → gitops/roles/, abstract-first. One small file per role (reach × power × session-tier × which-teams); the generators translate abstract role → Identity Center permission set + Keycloak role. Bespoke AWS inline policy via an optional escape-hatch field. Roles are admin-only. (→ #887)

Q2 — Person schema → PII-minimal + optional declared-tier handles. metadata.name (key) + spec.identity (email, displayName, optional github/slackId/pagerduty) + spec.grants. Handles are optional, ADR-084 declared tier — bootstrap/seed for the Phase-2/4 connectors, verified + upgraded on OAuth self-link, never block onboarding. Dropped the person: <keycloak-sub> field (standalone creates the user; metadata.name is the anchor). PII boundary: workforce operational IDs in private git = OK; customer/end-user PII in git = never — CIAM identity lives only in its per-Product runtime realm. (→ #886)

Q3 — Live-IAM cutover → a provable no-op. Seed gitops/people/ + gitops/roles/ to reproduce today's exact Identity Center state, flip the unit to derive, and gate the merge on terragrunt plan = 0 to add / change / destroy (the plan is the parity check). Don't touch the admin/break-glass permission set in the cutover; apply from the main repo root, AWS_PROFILE=management, eyeball 0 to destroy. (→ #888)

Q4 — Gate → a people-gate commit-status check (NOT CODEOWNERS). Clone of teams-gate: reads the diff, routes the required approver by what changed (team-lead for a team grant; access-admin for a platform role), author ≠ approver, fail-closed (read from base), SOLO_MAINTAINER self-attest waiver respected. CODEOWNERS can't express "this team's lead for this change." (→ #886)

[gangster]

Split: the master-realm admin-plane hardening moved out of #885 into its own issue #899 (separate effort). #885 stays scoped to platform-realm workforce phishing-resistant MFA.