Корпоративный мессенджер

Что можно построить

Корпоративный слой идентичности, где машина, которая выдает доступ, никогда не держит master key: HR аттестует сотрудников и contractors под grant department, messenger и Jira проверяют те же chains independently, и termination — одна revocation effective everywhere.

Как это работает

Корпорация аттестует каждый department once; HR machine derives и attests workers under that grant. Scope ceilings inherited — даже compromised HR machine не может создать employee с правами выше department’s.

flowchart LR
    C[Corporate seed] -->|attestHandle, 1 year| D["Handle: department-engineering"]
    D -->|attestSubHandle| W["SubHandle: worker-alice"]
    D -->|attestSubHandle, 14 days| X["SubHandle: contractor-x"]
    W -->|chain| V["Messenger + Jira verify"]

const worker = await deptHandle.deriveSubHandle(employeeId, {
  allowedAudiences: ['corp-messenger.internal', 'jira.internal'],
  allowedScopes: scopes,
  maxSessionTtl: 28800, // one workday
});
const B = await deptHandle.attestSubHandle(employeeId, {
  audiences: ['corp-messenger.internal', 'jira.internal'],
  scopes, maxSessionTtl: 28800,
}, { ttlSeconds: 365 * 24 * 3600 });

Бенефиты

• Split knowledge. Root key lives in a vault; HR operates on attested grants alone.
• No escalation path. channel:management outside the department grant is rejected by every verifier — SCOPE_EXCEEDED at level ROOT.
• One-operation offboarding. revokeAttestation(B.jti) kills all current and future sessions of the worker in every connected service.
• Contractors expire themselves. A two-week TTL needs no offboarding action on the end date.

Компромиссы

• Department grant is a ceiling. Privileges above it require a separate handle attested by the root directly.
• Mode 1 has no branch revocation. If internal tools verify verifyStateless, only per-session jti is revocable — use Mode 2 where offboarding matters.
• Alpha. Package APIs are pre-1.0; pin versions.

Ссылки

• Сценарий 7 в protocol Use Cases guide
• A production Redis RevocationChecker implementation