Milestone 4.P.1 — Identity, Tenancy & Authorization AssuranceCopy Anchor Link

Status: mounted-but-provisional — hard dependency for operator E2E; not closed by scaffolding. Outcome: Every request, stream, export, deletion, replay, secret use, and asynchronous job receives a server-derived tenant and policy decision. Track: Track P — Operator Readiness, Evidence & Control Plane Dependencies: P0; Track A identity/API foundations. P1 must be evidenced before D0 or P6-bootstrap proceeds. Estimated effort: 3 weeks Gate: G1 identity

Required server-side contractCopy Anchor Link

• Verify AuthService sessions with RS256 key rotation and revocation; provisional HMAC verification must not be reachable in shared environments.
• Derive org_id from the verified server session and membership, never from a client-controlled route, query, header, or browser storage value.
• Mount authentication, permission bits, resource/action classification, and deny-by-default policy checks on every API, SSE, export, mutation, and asynchronous worker path.
• Require fresh step-up for deletion, raw/export, production replay, secret changes, policy changes, break-glass, and other high-impact actions; expired, missing, or cross-tenant step-up must deny.
• Preserve explicit org_id filters in PostgreSQL, Redis, ClickHouse, object storage, queues, and read models.
• Keep policy epoch reconciliation fail-closed; narrow credential retrieval and block private-range or non-allowlisted provider URLs.

Verification gateCopy Anchor Link

P6-slice-certification must run a four-role/two-tenant matrix against the mounted runtime: viewer, operator, admin, and owner; Org B direct lookups return 404 where anti-enumeration applies and searches return empty; revoked sessions, expired step-up, policy-store outage, guessed IDs, org switching, and unscoped credential access deny. Evidence must identify the route or job, role, tenant, policy result, and artifact.

Rollout and rollbackCopy Anchor Link

Trigger: tenant leak, stale allow, fail-open policy, revoked-session acceptance, or secret exposure. Reversal: disable sensitive actions, return to metadata-only/read-only mode, and roll back policy versions without rewriting audit history. Verify: rerun the two-tenant matrix and confirm fail-closed responses.

Findings addressedCopy Anchor Link

F4-002, F4-006, F4-010, F4-015, F4-016, F4-017, F4-018.

Exit checklistCopy Anchor Link

• RS256 session verification/rotation, lifecycle, and revocation are mounted and evidenced.
• Server-derived org context is enforced on API, SSE, export, mutation, and job paths.
• Permission checks are mounted server-side; client visibility is not an authorization control.
• Step-up is mounted for every listed high-impact action and expiry denies.
• Four-role/two-tenant negative matrix is attached through P6-slice-certification.
• Policy-store outage, SSRF, credential-scope, and stale-revocation negative tests pass.