{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-PROCUREMENT-GCP-FEDERATION-01-v1",
  "record_kind": "external_reference",
  "title": "Workload federation: Trusted issuer and accepted identities",
  "system": "Google Cloud IAM",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does trusting an external identity provider let every identity from it access Google Cloud?",
  "near_questions": [
    "Which external identities pass the provider condition?",
    "Does issuer trust select a repository or tenant?",
    "What attributes are mapped?",
    "Can an attribute condition reject a credential?",
    "Is access granted directly or through impersonation?",
    "Which account is impersonated?",
    "What permissions does that account have?",
    "Does keyless access prove least privilege?",
    "Can two workloads share an overly broad identity mapping?",
    "Which resource grants should procurement inspect?",
    "When should an agent refuse an unidentified workload identity?",
    "Can I save the federation trust boundary?"
  ],
  "supported_claims": [
    {
      "claim": "Workload Identity Federation uses attribute mapping and can apply conditions to accept only selected external identities. Resource access then depends on direct IAM grants or service-account impersonation. Removing a stored service-account key does not establish a narrowly scoped trust relationship by itself.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Workload Identity Federation uses attribute mapping and can apply conditions to accept only selected external identities. Resource access then depends on direct IAM grants or service-account impersonation. Removing a stored service-account key does not establish a narrowly scoped trust relationship by itself.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Google Cloud Workload Identity Federation",
    "source_url": "https://docs.cloud.google.com/iam/docs/workload-identity-federation",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-GCP-FEDERATION-01-v1",
    "candidate_record_sha256": "b59dde9b59c29e884557b58f855c895a5198abb84a37803da72c7f8e97115ee1",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Workload Identity Federation uses attribute mapping and can apply conditions to accept only selected external identities. Resource access then depends on direct IAM grants or service-account impersonation. Removing a stored service-account key does not establish a narrowly scoped trust relationship by itself.",
    "required_buyer_context": "Issuer, mappings, provider conditions and resource authorization. Effective buyer configuration and dated operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Keyless federation automatically establishes least privilege.",
    "documented_statement": {
      "status": "documented",
      "statement": "Workload Identity Federation uses attribute mapping and can apply conditions to accept only selected external identities. Resource access then depends on direct IAM grants or service-account impersonation. Removing a stored service-account key does not establish a narrowly scoped trust relationship by itself.",
      "source_ids": [
        "gcp-federation"
      ]
    },
    "buyer_evidence_required": [
      "Issuer and attribute mapping.",
      "Provider condition and accepted identity set.",
      "Direct grants or impersonated account permissions."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require accepted-identity and resource scope before approving federation."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "gcp-federation",
        "url": "https://docs.cloud.google.com/iam/docs/workload-identity-federation",
        "final_url": "https://docs.cloud.google.com/iam/docs/workload-identity-federation",
        "title": "Google Cloud Workload Identity Federation",
        "checked_on": "2026-10-16",
        "sha256": "3e037114e368e373ab0327035df7920f1bbe6432e841edab90c24f5480313165",
        "bytes": 192288
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the identity-selection and resource-permission evidence for keyless access.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Issuer, mappings, provider conditions and resource authorization"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gcp-workload-federation-attribute-scope",
  "machine_readable_record": "/varexis-index/records/gcp-workload-federation-attribute-scope.json"
}