[Cenn0]

Roadmap

P2 / R03 / R06 / security issue #46. Extend the actual pinned Keycloak 26.8.1 Admin REST negative matrix instead of relying on Permora's application-level allowlists.

Implementation

• Reuse the same delegated App-A service account token for group role mapping, approved-group metadata change (known Groups.manage overbreadth) and out-of-scope attempts.
• Assert that this pinned Keycloak contract permits an approved group rename, followed by guaranteed metadata restoration.
• Direct negative tests for unauthorized foreign-group rename and deletion, adding/removing users as members of the allowed group, foreign-group role assignment, and Client-B role assignment.
• Validate no remote side effects with separate bootstrap-admin readbacks; do not mistake a returned 403 for a full postcondition proof.
• Add a focused operational FGAP acceptance runbook covering per-realm group policies, secret rotation, egress bypass tests, monitoring, audit, residual risks, and deployment-specific signoff.
• Refresh roadmap, release checklist, test guidance and docs navigation to reflect previously verified 20 Oct main/signed candidate.

Required verification and limitations

• Execute the live scripts/ci-keycloak-contract.py Keycloak 26.8.1 regression in GitHub Actions and confirm successful checks on this exact head.
• The group manage scope is still broader than mapping-only and an actual stolen Keycloak service token bypasses application allowlists. This PR is an exposure characterization and isolated regression, not a fix to the upstream privilege separation.
• Do not close issue Security blocker: FGAP Groups.manage permits group metadata changes #46, mark R03/R06 complete or claim Microsoft AD/multi-host/HA/pentest acceptance based on these tests.
• Preserve the default-deny AllowGroupRoleGrants=false posture.