state_owner

Establishes a normalized [StateOwner] from trusted identity sources.

Configuration Notes

Every configured header must be governed by a trusted upstream boundary. This filter validates and strips consumed headers; it does not authenticate their producer. In trusted_headers mode each component must select exactly one header or static source, and component header names must be distinct. single_tenant assigns the same tenant, issuer, and shared subject to every request. It is suitable only when the whole deployment is one trust domain; it cannot provide per-user attribution, cache separation, or state isolation. Shared multi-user deployments must use trusted_owner or trusted_headers. Agentic routers can snapshot request headers before the parent protocol commits body-phase removals, so each destination-owned IRR step must begin with project_state_owner_headers; it consumes the carried transport metadata, strips the raw ingress names in the child, and emits only configured outputs.

Examples

Example 1

filter: state_owner
mode: trusted_owner
header: x-authenticated-state-owner

Example 2

filter: state_owner
mode: trusted_headers
tenant:
  header: x-maas-tenant
issuer:
  static: https://authorino.example
subject:
  header: x-maas-user

Example 3

filter: state_owner
mode: single_tenant
tenant_id: local