FlowDrop Workflow Specification 1.0-draft

Authorization is decided before the handler, and travels with its cacheability

A response cached for one principal must never be served to another. That holds only if the authorization decision and the cache metadata describing what it depended on stay together.

The rule

Normative: this is the rule
  1. Authorization for a run's job surfaces is decided before the handler runs, and the decision's cache metadata travels with it, so a response cached for one principal cannot be served to another.
  2. The decision is the entity's own authorization result, forwarded unchanged rather than reduced to a boolean; a handler must not re-implement a subset of the model, because doing so both locks out principals the surface admits and ignores extension points the model honours.
  3. Authority over a job is not authority over a run: a run the caller may not view is refused before anything about it (its jobs, its summary, its label) is assembled.
  4. Absence is answered before denial, so a request for an identifier that does not exist is 404 even where a caller holding the surface's authority could not have viewed it; this is a decided trade, and identifiers must therefore carry no information beyond their existence.
Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · PIPE-6 · changed in spec 1.0