ADR-006: Verified enterprise identity and audited disclosure

Status: accepted educational architecture. Module: T18.7. Date: 2026-11-02. Supersedes: none; preserve ADR-001–005 execution, retrieval and overload contracts.

Tenant A requires auditable current access, organisational isolation and constrained provider egress. Baseline fixtures and trusted tenant predicates are necessary but do not implement corporate identity or network control. Compare pooled predicates plus production row-level defence, schema/database isolation and dedicated planes. Retain the pooled teaching baseline while making stronger isolation an explicit tenant/deployment decision rather than an assumed label.

Deployment must verify identity with bounded issuer/audience/key/type/expiry rules; bind trusted tenant/subject to live membership, policy epoch/freshness and resource access. Strip caller identity headers and propagate a narrowly scoped service capability through authenticated service channels. Treat document/model text as untrusted data, never as authorisation or tool policy.

Before protected retrieval disclosure, resolve current permitted source text and durably record the decision/protected source references. Audit failure blocks this route. Approved provider destinations and tenant-scoped secret references are runtime policy, separate from identity and networking. Private routing/mTLS does not remove resource checks.

The actual T18.4 Knowledge store is combined with signed public fixture envelopes, membership/audit tables and egress predicates. Ten tests cover tampering, audience/issuer/time, rotation, spoofed scope, cross-tenant/citation access, revocation/freshness/epoch, worker capability, audit failure/redaction and secret/provider scope. The envelope is deliberately not JWT/OIDC; no production identity, mTLS, RLS, KMS or private endpoint is deployed. Rechecks are observation points, not globally atomic revocation barriers. Audit metadata does not prove remote execution.

Observe policy/source lag, key/audience failures, stale denials, audit durability, denied egress and privileged tenant operations. Preserve disclosure semantics during authority/audit outages. T18.8 must explicitly choose consistency/failover per data class without turning stale cache or a failover replica into immediate authorisation authority.

• Deployment verifies identity against bounded issuer, audience, key, type and expiry rules, then binds tenant and subject to live membership and policy epoch. Caller identity headers are stripped and services pass a narrowly scoped capability over authenticated channels.
• The pooled-predicate baseline stays, and schema, database or dedicated-plane isolation becomes an explicit per-tenant deployment decision rather than an assumed label. Private routing or mTLS never replaces resource checks, and document or model text is never authorisation.
• Protected retrieval disclosure is durably audited first, and an audit failure blocks the route. Later consistency and failover choices must never make a stale cache or a failover replica an authorisation authority.