Enterprise security: validate and carry forward

1. What is trusted tenant scope? Verified identity plus current membership, never caller headers or model output.
2. What does an audience constrain? Which service may consume a credential; service identity still needs action/resource scope.
3. Why are policy age and token expiry separate? A still-valid identity assertion may outlive current access.
4. What is safe in audit? Protected identifiers, action, decision and provenance metadata under controlled access; not raw bearer/source bodies.
5. What is not demonstrated? Production OIDC, private routes, mTLS, secret storage, RLS and a global immediate revocation guarantee.

The 60-second card: verify identity; bind current scope; separate service and user authority; recheck resources; treat documents as data; commit audit; constrain secrets/egress; preserve unknown external outcomes. Review after about one, seven and 21 days.

• Explain identity, authorisation and disclosure boundaries without notes in two minutes.
• Draw gateway, service identity, current policy, retrieval, audit and egress boundaries.
• Defend pooled versus isolated tenants and public-constrained versus private provider access.
• Diagnose spoofing, stale policy, audit failure and wrong-audience credentials using concrete signals.
• Run/modify the signed-fixture and existing-retrieval integration tests; learner mastery remains unassessed.

ADR-006 and the stage snapshot preserve the actual teaching evidence.

A future T18.8 addresses authority lag, dependency outage, failover and duplicate effects without weakening these disclosure/audit rules. It must distinguish stale body reuse from stale authorisation. No security deployment or certification is claimed here.

• RFC 8725: production JWT verification and audience/type-confusion boundaries; the fixture envelope is not its implementation.
• OWASP authorisation guidance: trusted per-resource least-privilege checks.
• OWASP prompt injection: untrusted content and model-control risks that retrieval alone does not remove.

Sources checked 2 November 2026. Policy ages, traffic and overhead are authored assumptions; executed checks and missing integrations are in validation.

• Trusted tenant scope is verified identity plus current membership, never caller headers or model output. An audience limits which service may consume a credential, and that service still needs action and resource scope.
• Policy age and token expiry are tracked separately because a still-valid identity assertion can outlive current access.
• Audit may hold protected identifiers, action, decision and provenance metadata under controlled access. It never holds raw bearer tokens or source bodies.
• Production OIDC, private routes, mTLS, secret storage, row-level security and a global immediate revocation guarantee are not demonstrated by the local fixtures.