gcp-certmanager-cert-credentials-for

id: gcp-certmanager-cert-credentials-for
emits: CredentialsFor
description: A cert signed by the CA authenticates as the subject/SAN it names to a consuming trust.
match:
- - principal: null
  - CanSignAs
  - capool: null
where:
- node_type(?capool) == CaPool (SigningKey)
- the forgeable/issued certificate names a subject/SAN that a consuming trust maps to ?target (identity
  / service account / data-plane endpoint)
- node_type(?target) in [Identity, ServiceAccount, ServiceIdentity, Data]
emit:
  source: <certificate node (or the forgeable cert the CA would sign)>
  target: <identity / service account / data store the subject/SAN authenticates>
  permissions: []
  conditions:
  - condition_expression
  - trust_relationship
  state_logic: ACTIVE when a concrete cert with the subject/SAN exists AND a consuming trust maps it to
    ?target; CONDITIONAL(condition_expression, trust_relationship) when this is a forgeable (not-yet-issued)
    cert gated by the issuance policy and/or the consuming trust is unconfirmed; POTENTIAL when the subject/SAN
    -> target mapping is unresolved.
  confidence: "0.7 (heuristic subject->identity mapping) \u2014 raise to 0.95 when the consuming trust\
    \ explicitly maps the SAN (e.g. SPIFFE ID / bound workload identity)"
  derived_from:
  - <CanSignAs edge_id>
  - <subject/SAN -> target trust-mapping evidence>
  false_positive_note: 'ASSERTION about what a cert authenticates, not an observed session. Zero base
    weight: value comes only when paired with CanSignAs and a real trust consumer. Only emit a concrete
    ?target when a consumer maps the subject/SAN to it; if the mapping is unknown, emit POTENTIAL rather
    than a guessed identity. Do NOT emit CredentialsFor for a cert whose subject is the caller itself
    (createForSelf).'
  narrative: A certificate signed by {capool.name} naming {target.name} in its subject/SAN is a credential
    for {target.name} wherever that CA is trusted.