ADR-0022: Sector-level grants with organizational attribute verification¶
- Status: deferred
- Date: 2026-08-24 (proposed), deferred on 2026-11-02
- Satisfies: S04, P-16
- Deliberation: reference architecture v0.6.2, authorization models analysis ยง9.5 (archived and unpublished), F-36, SL-05
- Implemented in: not implemented. gbo-demo removed the
sector-pipscaffolding (#378, CHANGELOG).
Why deferred¶
In gbo-demo v0.9.0, admission runs through the admission register (toelatingsregister) and the contract decision of the PDP (REQ-61, ADR-0015). No component called the sector PIP, so the demo removed it. A sector grant is not a native FSC concept (F-36). The proposal stays in the log for one case: per-organization admission does not scale. Work on it starts only after a new decision.
Context and problem statement¶
PKI proves which organization calls (OIN). PKI does not prove what kind of organization it is. Per-organization contracts do not scale to sectors. For example, 800 notary offices need 800 contracts with each source.
Proposed decision (deferred)¶
The proposal extends contract acceptance and token issuance with organizational attributes:
- Sector PIPs (KvK SBI, KNB, BIG, AFM) verify sector membership.
- A sector-level grant type expresses "this sector may use this service".
- The access token carries verified sector claims.
This proposal builds on contract acceptance by policy (ADR-0015). The autosign input then must carry more than peer IDs.
Open points¶
The proposal leaves three points open:
- An extension of the FSC grant schema, through the Logius standards process.
- The freshness of sector register data, and the liability for it.
- The relation with the admission register: admission versus membership.