client authorization
authorization client-authorization.yaml
This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.
Validates against the authorization schema — try it: POST /v1/validate with {"schema": "authorization", "document": …}.
The document (YAML original)
authorization_id: AUTH-DEMO-2026-001
client_id: client-demo
approved_by: Demo Client Security Owner
valid_from: "2026-09-01T00:00:00-06:00"
valid_until: "2026-10-01T23:59:59-06:00"
allowed_modes:
- inventory
- audit
- passive
- change
targets:
- kind: domain
value: security-demo.example.com
environments: [production]
- kind: ip
value: 203.0.113.10
environments: [production]
- kind: domain
value: "*.staging.security-demo.example.com"
environments: [staging]
limits:
max_requests_per_second: 1
max_concurrency: 1
max_duration_minutes: 15
max_error_rate: 0.05
max_latency_ms: 3000
forbidden_actions:
- denial-of-service
- stress-testing
- phishing
- credential-guessing
- persistence
- data-exfiltration
- production-active-scan
maintenance_windows:
- start: "2026-09-10T22:00:00-06:00"
end: "2026-09-10T23:00:00-06:00"
description: Approved VPS hardening window
emergency_contact: security-owner@security-demo.example.com
data_handling:
classification: confidential
retention_days: 90
region: ca
redact:
- authorization
- cookie
- password
- api-key
- personal-data
proof_of_control:
method: dns-txt
status: verified
verified_at: "2026-09-01T09:00:00-06:00"
evidence_reference: evidence://client-demo/ownership/dns-proof.json
signatures:
- signer: Demo Client Security Owner
signed_at: "2026-09-01T09:05:00-06:00"
signature_reference: signature://client-demo/AUTH-DEMO-2026-001
As JSON
{
"authorization_id": "AUTH-DEMO-2026-001",
"client_id": "client-demo",
"approved_by": "Demo Client Security Owner",
"valid_from": "2026-09-01T00:00:00-06:00",
"valid_until": "2026-10-01T23:59:59-06:00",
"allowed_modes": [
"inventory",
"audit",
"passive",
"change"
],
"targets": [
{
"kind": "domain",
"value": "security-demo.example.com",
"environments": [
"production"
]
},
{
"kind": "ip",
"value": "203.0.113.10",
"environments": [
"production"
]
},
{
"kind": "domain",
"value": "*.staging.security-demo.example.com",
"environments": [
"staging"
]
}
],
"limits": {
"max_requests_per_second": 1,
"max_concurrency": 1,
"max_duration_minutes": 15,
"max_error_rate": 0.05,
"max_latency_ms": 3000
},
"forbidden_actions": [
"denial-of-service",
"stress-testing",
"phishing",
"credential-guessing",
"persistence",
"data-exfiltration",
"production-active-scan"
],
"maintenance_windows": [
{
"start": "2026-09-10T22:00:00-06:00",
"end": "2026-09-10T23:00:00-06:00",
"description": "Approved VPS hardening window"
}
],
"emergency_contact": "security-owner@security-demo.example.com",
"data_handling": {
"classification": "confidential",
"retention_days": 90,
"region": "ca",
"redact": [
"authorization",
"cookie",
"password",
"api-key",
"personal-data"
]
},
"proof_of_control": {
"method": "dns-txt",
"status": "verified",
"verified_at": "2026-09-01T09:00:00-06:00",
"evidence_reference": "evidence://client-demo/ownership/dns-proof.json"
},
"signatures": [
{
"signer": "Demo Client Security Owner",
"signed_at": "2026-09-01T09:05:00-06:00",
"signature_reference": "signature://client-demo/AUTH-DEMO-2026-001"
}
]
}