Skip to content

ADR-002: Organization-to-Worker Assignment

Status: ACCEPTED.

Context

Distributed Workers need server-side authorization. A Worker must not be able to request tasks for an arbitrary organization by including an organization ID in a request.

Worker deployment location does not define authorization. A customer-hosted Worker is still a normal Scanner Worker, but Gateway must decide which organizations it may serve.

Decision

Use a many-to-many organization-to-Worker assignment model:

Organization <-> Worker
  • An organization can have multiple assigned Workers.
  • A Worker can be assigned to multiple organizations.
  • Assignments are stored centrally.
  • Gateway enforces assignments before leasing tasks.
  • Worker self-declared organization IDs are not authorization.

Worker Pools may be added later as an optional grouping abstraction, but they are not mandatory for v1 authorization.

Authorization boundaries

Gateway must authorize every task lease using:

  • authenticated Worker identity;
  • organization-to-Worker assignment;
  • task organization;
  • required task capabilities;
  • Worker availability and capacity.

Gateway must also validate result submission against the active task lease.

Task routing implications

Eligible Worker selection requires:

  1. Worker is authenticated.
  2. Worker is assigned to the task organization.
  3. Worker advertises required scanner capabilities.
  4. Worker has available capacity.
  5. Worker version/protocol is compatible.

Assignment revocation

Revocation must immediately prevent new task leases.

Running tasks need an explicit policy. Recommended default:

  • stop new leases immediately;
  • allow already running tasks to finish for routine maintenance revocation;
  • cancel active leases for security-driven revocation.

All revocations and denied lease attempts should be auditable.

Alternatives

  • Organization-to-Worker one-to-many only.
  • Worker Pools as mandatory v1 routing primitive.
  • Worker-provided organization ID as authorization input.

Consequences

  • Routing remains simple and explicit.
  • Customer-hosted Workers can be safely scoped without special execution logic.
  • Worker Pools can be introduced later without changing the core authorization rule.