Deliver authentication and RBAC across Scope #17

Original author: Cedric Vidal (@cedricvidal)

Goal

Deliver authenticated, permission-controlled access to Scope from human clients
and internal services.

Delivery tracks

Use the native sub-issues on this issue as the progress tracker. Implementation
milestones stay inside their owning child rather than becoming more delivery
issues by default.

This parent is the overall tracker, not a fourth implementation PR.

Supporting Portal authentication delivery

PR #1531 - Authenticate log streaming, artifact downloads, and video playback
is the Portal authenticated-delivery foundation for RBAC. It carries the existing
human IdP JWT through streaming logs, downloads, and progressive video requests
that cannot directly use the normal browser bearer transport.

This is credential delivery, not a new token issuer or permission policy. It
complements, and is not replaced by, the service/job JWT work in #1557. Track the
existing PR here without creating another delivery sub-issue.

Dependencies

• The current RBAC implementation, PR feat: add project membership RBAC and administration #1532 for Enforce project membership RBAC and administration #1300, is stacked on and depends
  on PR fix: authenticate log streaming, artifact downloads, and video playback #1531. Preserve that Portal delivery foundation when integrating RBAC.
• RBAC auth-on rollout in Enforce project membership RBAC and administration #1300 requires the service-auth delivery in Authenticate internal services with JWT #1557.
  Coordinate their principal/policy integration without a circular dependency.
• CLI development can proceed independently through the existing human
  IdP/enrollment boundary and supplied public-client/API configuration.
• JWT infrastructure is assumed supplied for this Scope work. Reference
  growth-ecosystems/scope-core-infra#150
  for the external foundation; do not duplicate that research as a Scope child.
  This planning assumption is not a claim that infrastructure is deployed.

Integrated acceptance criteria

• All three delivery sub-issues are complete.
• A CLI user can sign in and run authenticated, authorized commands without
  manually obtaining access tokens; credential refresh and logout work.
• API, Portal, and CLI behavior consistently respects project membership and
  permissions, including criteria management and run submission/backfill.
• Portal logs, artifact/archive downloads, and progressive video playback
  and seeking work with human bearer authentication and RBAC enforcement enabled.
• Agent/version registration, model scanning, worker content loading, and
  benchmark evaluation work with authentication enabled in Compose and AKS.
• Missing/invalid credentials, unauthorized operations, and cross-project
  access are denied without an anonymous or blanket-administrator bypass.
• Job completion/cancellation/reclaim and concurrent/long evaluations
  preserve the service authority lifecycle.
• Existing human enrollment, public probes, and supplied-bearer CLI usage
  remain intentional and covered; documentation matches the delivered behavior.

Shared exclusions

Report authentication/post-run report triggers, submitter-rights binding,
Scope PAT issuance, and authentication of unrelated internal-service endpoints
remain separate work. Membership removal alone does not independently revoke
an active job in the initial service-authority model.

Related work

• Support runtime Portal authentication configuration #1450 - Portal runtime authentication configuration. Related only; do not
  absorb or duplicate its scope without checking overlap with PR feat: add project membership RBAC and administration #1532.
• [Archived PR] feat(auth): implement Entra ID authentication in API #1338 and [Archived PR] spec: Authentication & RBAC #1079 - imported archived authentication/specification PRs, retained
  as historical references rather than active delivery children.

Original request

You need to be able to control who can create manage and editor criteria as
well as who can submit and backfill runs