Bootstrap authorisation policy

This is the bootstrap policy: the very first sdg:PolicyDocument the registry publishes at service startup. It grants the minimum permissions needed to get from "no policy exists" to "normal operation", and it is intentionally permissive.

Rules

  1. sdg:BootstrapOperator may publish any document. This is the operator-configured role that exists in registry code before any in-graph policy to evaluate against. It solves the chicken-and-egg problem of authorising the publish of the very policy that governs publishing.
  2. sdg:Publisher may publish documents under the sample namespace (http://example.org/docs/). A Phase 1 convenience for the demo storyboards — exercises the write path without requiring real identity.
  3. sdg:Authenticated may read any graph. Phase 1 leaves reads open; Phase 4 replaces this with ABAC query rewriting.

Lifecycle

After bootstrap, organisations extend authorisation by publishing additional sdg:PolicyDocuments. Each publish goes through the full four-gate pipeline, including gate 1 evaluating against the current policy set — so the bootstrap is the one-time exception that enables normal operation, not an always-on bypass.

What this does NOT do

  • Does not grant write access to the org-owned store for arbitrary agents. Tag application authorities are declared in separate, later-published policy documents.
  • Does not exempt anyone from gate 2 (core invariants) — version-graph immutability is non-overridable by policy.
Bootstrap authorisation policy — Sparqdown Docs