{"id":"governance-spans-identity-resources-and-namespaces","text":"OpenShift governance operates across three reinforcing layers: identity management (OAuth → User → Identity chain), resource access control (dual auth systems + quota enforcement), and namespace provisioning (self-service with admin disable controls and custom templates), ensuring no resource is accessible without passing through all three gates.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[{"type":"SL","antecedents":["authorization-and-resource-governance-model","openshift-identity-lifecycle-chain","project-self-provisioning-governance"],"outlist":[],"label":"Depth-3 — the three governance layers (identity, resource, namespace) interact: project self-provisioning is constrained by both identity chain and resource quotas"}],"dependents":["autoscaling-placement-within-governance","governance-controls-image-supply-chain","platform-governance-from-identity-to-node"],"metadata":{},"explanation":{"steps":[{"node":"governance-spans-identity-resources-and-namespaces","truth_value":"IN","reason":"SL justification valid","antecedents":["authorization-and-resource-governance-model","openshift-identity-lifecycle-chain","project-self-provisioning-governance"],"label":"Depth-3 — the three governance layers (identity, resource, namespace) interact: project self-provisioning is constrained by both identity chain and resource quotas"},{"node":"authorization-and-resource-governance-model","truth_value":"IN","reason":"SL justification valid","antecedents":["openshift-extends-k8s-authorization-model","quota-forces-complete-resource-declarations"],"label":"Authorization gates who can act; quotas gate how much — both enforce strictness"},{"node":"openshift-extends-k8s-authorization-model","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-two-authorization-api-groups","openshift-has-own-authorization-api","scc-api-group-security-openshift","default-clusterroles-list"],"label":"Parallel authorization APIs reflect OpenShift's extension of Kubernetes security model"},{"node":"ocp-two-authorization-api-groups","truth_value":"IN","reason":"premise"},{"node":"openshift-has-own-authorization-api","truth_value":"IN","reason":"premise"},{"node":"scc-api-group-security-openshift","truth_value":"IN","reason":"premise"},{"node":"default-clusterroles-list","truth_value":"IN","reason":"premise"},{"node":"quota-forces-complete-resource-declarations","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-quota-forces-explicit-resource-specs","ocp-extended-resources-no-overcommit"],"label":"Quotas enforce exhaustive resource declarations with no implicit defaults"},{"node":"ocp-quota-forces-explicit-resource-specs","truth_value":"IN","reason":"premise"},{"node":"ocp-extended-resources-no-overcommit","truth_value":"IN","reason":"premise"},{"node":"openshift-identity-lifecycle-chain","truth_value":"IN","reason":"SL justification valid","antecedents":["oauth-config-singleton-named-cluster","oauth-requires-integratedoauth-type","user-api-group-user-openshift-io","useridentitymapping-maps-user-to-identity","oauthclientauthorization-delete-revokes"],"label":"Five resources form a directed chain from authentication config to session lifecycle"},{"node":"oauth-config-singleton-named-cluster","truth_value":"IN","reason":"premise"},{"node":"oauth-requires-integratedoauth-type","truth_value":"IN","reason":"premise"},{"node":"user-api-group-user-openshift-io","truth_value":"IN","reason":"premise"},{"node":"useridentitymapping-maps-user-to-identity","truth_value":"IN","reason":"premise"},{"node":"oauthclientauthorization-delete-revokes","truth_value":"IN","reason":"premise"},{"node":"project-self-provisioning-governance","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-admin-can-disable-self-provisioning","ocp-disable-self-provisioning-two-steps","project-request-template-in-openshift-config-ns","project-request-message-shown-when-denied"],"label":"Four beliefs describe the complete self-provisioning governance lifecycle"},{"node":"ocp-admin-can-disable-self-provisioning","truth_value":"IN","reason":"premise"},{"node":"ocp-disable-self-provisioning-two-steps","truth_value":"IN","reason":"premise"},{"node":"project-request-template-in-openshift-config-ns","truth_value":"IN","reason":"premise"},{"node":"project-request-message-shown-when-denied","truth_value":"IN","reason":"premise"}]}}