Theory

Updated

October 30, 2026

Theory: Authn is Who; Authz is What a Ref May Do

A forge maps credentials to a principal, then to permissions on repos, orgs, and refs. SSH keys, OAuth, SAML, and LDAP are different proofs of the same principal problem.

Invariants

  1. Password/SSH/OAuth/SAML all produce a session or git credential.
  2. RBAC is groups × resources × verbs (clone, push, admin, force).
  3. Fine-grained tokens are more blast-radius-aware than a single password.
  4. MFA protects the account, not a stolen deploy key unless you require it.
proof (key/token/SAML) → principal → role → refs + APIs

What can break

  • Deploy keys with write access in CI forever.

How to read this chapter

Methods, LDAP, RBAC, keys at scale, MFA.