{"id":"authorization-and-resource-governance-model","text":"OpenShift enforces a comprehensive governance model: dual authorization systems (OpenShift auth + K8s RBAC) control access to resources, while resource quotas force explicit declarations — together creating a contract where both access and consumption are strictly governed.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[{"type":"SL","antecedents":["openshift-extends-k8s-authorization-model","quota-forces-complete-resource-declarations"],"outlist":[],"label":"Authorization gates who can act; quotas gate how much — both enforce strictness"}],"dependents":["governance-spans-identity-resources-and-namespaces"],"metadata":{},"explanation":{"steps":[{"node":"authorization-and-resource-governance-model","truth_value":"IN","reason":"SL justification valid","antecedents":["openshift-extends-k8s-authorization-model","quota-forces-complete-resource-declarations"],"label":"Authorization gates who can act; quotas gate how much — both enforce strictness"},{"node":"openshift-extends-k8s-authorization-model","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-two-authorization-api-groups","openshift-has-own-authorization-api","scc-api-group-security-openshift","default-clusterroles-list"],"label":"Parallel authorization APIs reflect OpenShift's extension of Kubernetes security model"},{"node":"ocp-two-authorization-api-groups","truth_value":"IN","reason":"premise"},{"node":"openshift-has-own-authorization-api","truth_value":"IN","reason":"premise"},{"node":"scc-api-group-security-openshift","truth_value":"IN","reason":"premise"},{"node":"default-clusterroles-list","truth_value":"IN","reason":"premise"},{"node":"quota-forces-complete-resource-declarations","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-quota-forces-explicit-resource-specs","ocp-extended-resources-no-overcommit"],"label":"Quotas enforce exhaustive resource declarations with no implicit defaults"},{"node":"ocp-quota-forces-explicit-resource-specs","truth_value":"IN","reason":"premise"},{"node":"ocp-extended-resources-no-overcommit","truth_value":"IN","reason":"premise"}]}}