ADR-0014: Flow and subject identifier semantics through a provider-side Additional Claims service¶
- Status: superseded by ADR-0030, which ADR-0031 supersedes in turn
- Date: 2026-08-24
- Satisfies: P-01, D-11
- Deliberation: gbo-demo CHANGELOG, v0.6.11, F-62
- Implemented in: removed from gbo-demo in v0.6.11 (September 2026)
Context and problem statement¶
The PDP selects rules by the flow of the request (dvtp:query,
eudi:attestation, gbo:source-metadata). The source gateway interprets the
subject identifier (pseudonym or direct). If callers supply these
values as headers, a caller can choose the authorization regime that
applies to its request.
Decision (superseded)¶
An Additional Claims service that the provider owned mapped each validated
connection grant (outway peer, service peer, service name) to an add
claim object. The FSC Manager of the provider signed this object into the
access token. The PDP mapper and the source gateway read only the add claim.
Why it was superseded¶
The mechanism was a workaround for a version limit. The simulation environment ran OpenFSC v1.44, which is older than grant properties. The mechanism had two costs:
- Only the provider signed the regime. The consumer never countersigned it.
- The mapping file from grants to claims was outside the contracts. People had to maintain it by hand, and it broke twice during the Peer-ID migration.
When OpenFSC v2.4.0 became available, the regime moved into the contract itself, as FSC-normative grant properties. For this design, see ADR-0030.