wardline Docs

Features

One page per capability: what problem it solves, the minimal config to turn it on, and its known, honestly-documented limitations. The v0.1 baseline is always on; most other capabilities are opt-in behind a features flag in wardline.yaml. Compliance evidence export and the policy-pack marketplace are the exceptions — both are always-available CLI subcommands, not gated by any flag.

  • Proxy, Policy & Audit (baseline) — Always on — reverse proxy, policy decision, audit log.
  • Credential Issuance — Short-lived, RS256-signed identity tokens with revocation.
  • SSO — OIDC ID-token bootstrap for Wardline's own admin identity and tenant.
  • mTLS/SPIFFE Bootstrap — Bootstrap credential issuance from an already-verified SPIFFE ID, forwarded by a terminating mTLS proxy or mesh.
  • RBAC — Role-based access to Wardline's own admin surface.
  • SCIM — SCIM-shaped Users/Groups provisioning that maps IdP group membership to RBAC role bindings.
  • Budget Enforcement — Per-identity request-rate limiting.
  • Anomaly Detection — Rule/statistics and ML-based detection of unusual agent behavior, with optional auto-block.
  • Federation — Cross-instance anomaly correlation: peers exchange signed, pseudonymized summaries and raise an alert when the same fingerprint is seen by multiple instances.
  • Web Dashboard — The in-browser Overview/Activity/Anomalies/Blocked/Federation/Credentials/Policy/Status view.
  • Compliance Evidence Export — Point-in-time, checksum-verified, optionally RSA-signed evidence bundle — on demand or on a schedule — plus a live aggregate-counts API.
  • Auto-Generated Sandbox Policy — Infer a starter policy.yaml from observed audit traffic.
  • Policy-Pack Marketplace — Curated, embedded policy-pack catalog (YAML/OPA/Cedar) with list/show/install/compose and an operator-owned pack directory.
  • gRPC Transport — Front a gRPC upstream on a second listener, running the same identity, policy, budget, audit, and auto-block pipeline as the HTTP proxy.
  • HA Deployment — Multi-replica correctness for credential issuance, plus real health/readiness.