Ironflow Auth and RBAC

Ironflow Auth and RBAC A workflow diagram generated by Archify. 01 / Caller 02 / Identity resolution 03 / Authorization EX / Denied Who is calling What is being asked Two-layer decision Incoming request · header or cookie · Caller › Who is calling Incoming request header or cookie JWT · verify signature, read claims · Caller › Who is calling · dashboard login JWT verify signature, read claims dashboard login API key · SHA-256 hash, api_keys lookup · Identity resolution › Who is calling · ifkey_ / ifplatform_ API key SHA-256 hash, api_keys lookup ifkey_ / ifplatform_ Roles + IRN · role set, verb, target IRN · Identity resolution › What is being asked · 7-segment IRN Roles + IRN role set, verb, target IRN 7-segment IRN L1 system RBAC · built-in role to verb map · Authorization › Two-layer decision · authoritative ALLOW L1 system RBAC built-in role to verb map authoritative ALLOW L2 tenant Rego policy set · subtractive, deny wins · Authorization › Two-layer decision · opt-in, off by default L2 tenant Rego policy set subtractive, deny wins opt-in, off by default Allow · handler runs, 200 · Authorization › Two-layer decision Allow handler runs, 200 Deny · 403, nothing executes · Denied › Two-layer decision Deny 403, nothing executes evaluate user_roles api_key_roles no verb match then narrow no deny policy denies JWT or cookie not a JWT Legend Request context Auth decision Caller / response