Epic: Kuadrant AuthPolicy

[araujof]

Be compatible with the Kuadrant AuthPolicy API: any valid AuthPolicy should translate to Praxis configuration and be enforced with the same semantics.

Where we are

The PoC from #716 delivered:

• feat(policy): authpolicy transpiler demos#6: transpile-authpolicy CLI that ingests an AuthPolicy and emits a Praxis policy filter block plus a CPEX policy document, with a coverage report classifying every construct as translated, approximated, or skipped.
• feat(policy): generic-HTTP authorization derived from the policy #806: generic-HTTP (L7) authorization in the policy filter, so the emitted config actually enforces. Experimental, feature-gated.

Covered today: JWT authentication, CEL authorization (patternMatching, when, patterns, and the legacy selector/operator/value form), and the RBAC membership idiom mapped onto CPEX role.*, perm.*, team.*.

Everything else is reported rather than silently dropped. This epic tracks closing those reports one by one.

Scope

• Subset or every AuthPolicy authentication methods, credential location, and rule priority/fallback semantics (set decision and scoping).
• Subset or every authorization backend (set decision and scoping).
• metadata and callbacks.
• response.success injection and denyWith on both authentication and authorization denials.
• defaults/overrides and Gateway to route merge.
• Gateway API targetRef binding (?).
• A compatibility matrix and conformance suite that gates coverage claim.

Non-goals

• Reverse translation (Praxis config to AuthPolicy).
• Authorino as the enforcement engine. Praxis implements its own native Policy Engine.
• gJSON expressions, deprecated upstream.

Sub-Tasks

Need a discussion on the following items to decide final scope of work.

• apiKey authentication [FEATURE]: Secret management plugin (Vault / Infisical) contextforge-org/cpex#139
• x509 / mTLS authentication
• oauth2Introspection authentication
• kubernetesTokenReview authentication
• anonymous authentication
• Credential locations (credentials: header, query string, cookie)
• Authentication rule priority and fallback
• JWT signing algorithms and audiences
• Scalar and nested identity claims in CEL
• opa authorization
• spicedb authorization
• kubernetesSubjectAccessReview authorization
• metadata (http, userInfo, uma) and auth.metadata.* in CEL
• callbacks
• denyWith custom denial responses
• response.success header and dynamic metadata injection
• defaults / overrides and Gateway to route merge
• Gateway API targetRef binding
• Evaluator result caching (cache)
• Global HTTP baseline on classified non-entity MCP methods
• Compatibility matrix and conformance suite

Area

Security