Ideas · Builder Notes
Closing the library path: credentials and tier limits
Kognita alpha now requires a live workload credential on the library path and keeps tier 2 and above use cases gateway-only at runtime.
Context
The library path was weaker than the gateway: it skipped credentials in some cases and checked deployment mode only at registration.
Decision
- decide() without a register denies.
- The credential check is unconditional on the library path.
- Tier 2 and above use cases are refused in library mode at runtime as well as at registration.
- Revocation, step-up binding and anomaly windows were tightened.
Why
Every path should enforce the same rules.
Outcome
The library and gateway paths are aligned.
Open
Library mode is now limited to low-tier use cases.
Audit every entry point, not just the main one.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #76, Kognita PR #111 in the Kognita repository.