Ironflow Auth and RBAC

Ironflow Auth and RBAC A workflow diagram generated by Archify. 01 / Caller 02 / Identity resolution 03 / Authorization EX / Denied Who is calling What is being asked Two-layer decision Incoming request · header or cookie · Caller › Who is calling Incoming request header or cookie JWT · verify signature, read claims · Caller › Who is calling · dashboard login JWT verify signature, read claims dashboard login API key · SHA-256 hash, api_keys lookup · Identity resolution › Who is calling · ifkey_ / ifplatform_ API key SHA-256 hash, api_keys lookup ifkey_ / ifplatform_ Roles + IRN · role set, verb, target IRN · Identity resolution › What is being asked · 7-segment IRN Roles + IRN role set, verb, target IRN 7-segment IRN L1 system RBAC · built-in role to verb map · Authorization › Two-layer decision · authoritative ALLOW L1 system RBAC built-in role to verb map authoritative ALLOW L2 tenant CEL · subtractive, deny wins · Authorization › Two-layer decision · not yet wired L2 tenant CEL subtractive, deny wins not yet wired Allow · handler runs, 200 · Authorization › Two-layer decision Allow handler runs, 200 Deny · 403, nothing executes · Denied › Two-layer decision Deny 403, nothing executes evaluate user_roles api_key_roles no verb match then narrow no deny policy denies session cookie ifkey_ prefix Legend Request context Auth decision Caller / response

Two credentials, one role set

  • • API key: SHA-256 of the key looks up api_keys (internal/auth/apikey)
  • • JWT: dashboard login, verified against .ironflow_jwt_secret
  • • ifplatform_ keys also pass a platform guard and need X-Ironflow-Org

Why two layers

  • • L1 system RBAC is the only layer that grants — roles map to verbs (ADR 0015)
  • • L2 tenant CEL is subtractive: it denies, never adds (ADR 0016)
  • • Deny wins in both layers; results are cached per policy epoch

L2 is not live yet

  • • rbac.Evaluator() returns the L1-only RBACEvaluator; LayeredEvaluator is test-only
  • • Tenant CEL policies store and version without changing live decisions