thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/lambda-api/iam-grouped.tf

@@ -6,25 +6,25 @@
 # 10,240-byte aggregate hard cap for inline policies (#2378 failed the dev
 # apply with LimitExceeded; #2379 is this consolidation). Every grant that was
 # inline on this role — plus the one-off standalone managed policies that had
-# accreted as cap workarounds — now lives in exactly four grouped
+# accreted as cap workarounds — now lives in five grouped
 # customer-managed policies:
 #
 #   thinkwork-<stage>-api-data-plane     — RDS Data API, Secrets Manager, S3,
 #                                          DynamoDB, Cognito, SSM reads, KMS,
 #                                          SQS (here for size balance, see
 #                                          the locals note)
-#   thinkwork-<stage>-api-orchestration  — lambda:InvokeFunction, Scheduler,
-#                                          Step Functions, SES
-#   thinkwork-<stage>-api-ai             — Bedrock invoke, Knowledge Bases,
+#   thinkwork-<stage>-api-orchestration  — Scheduler, Step Functions, SES
+#   thinkwork-<stage>-api-invocation     — internal lambda:InvokeFunction
+#   thinkwork-<stage>-api-ai             — Bedrock invoke,
 #                                          AgentCore memory/eval/code-interp
 #   thinkwork-<stage>-api-observability  — CloudWatch Logs reads, ECS/ALB
 #                                          health reads
 #
-# STANDING RULE: new grants for aws_iam_role.lambda go into one of these four
+# STANDING RULE: new grants for aws_iam_role.lambda go into one of these five
 # grouped policies — never a new inline aws_iam_role_policy and never a new
 # standalone managed-policy attachment. (Managed-policy attachments have a
 # default quota of 10 per role; the steady state here is
-# AWSLambdaBasicExecutionRole + these four, plus the conditional AWS-managed
+# AWSLambdaBasicExecutionRole + these five, plus the conditional AWS-managed
 # VPC-access policy when OKF EFS wiring is enabled.)
 #
 # Each managed policy document caps at 6,144 characters (JSON minus
@@ -59,16 +59,6 @@ locals {
         Action   = ["secretsmanager:GetSecretValue"]
         Resource = var.graphql_db_secret_arn
       },
-      # THINK-239 — analystInternalClusters enumerates the environment's own
-      # RDS clusters (filtered to thinkwork-<stage>-* in code) so operators can
-      # register a database with zero credential entry. Describe-only; the
-      # admin credential read is covered by graphql_db_secret_arn above.
-      {
-        Sid      = "AnalystInternalClustersDescribe"
-        Effect   = "Allow"
-        Action   = ["rds:DescribeDBClusters"]
-        Resource = "*"
-      },
       {
         Effect = "Allow"
         Action = [
@@ -76,14 +66,6 @@ locals {
           "secretsmanager:UpdateSecret",
           "secretsmanager:DeleteSecret",
           "secretsmanager:GetSecretValue",
-          # THINK-230 — provisionAnalystConnector writes the broker credential
-          # secret value (thinkwork/<stage>/analyst/broker-credential, under
-          # this thinkwork/* prefix) via ensureAnalystBrokerSecret's
-          # PutSecretValue. GetSecretValue above already covers the read; this
-          # role already holds Create/Update/Delete on the same prefix, so
-          # PutSecretValue grants no capability beyond the existing delete +
-          # recreate. Kept on the existing statement to stay under the 6,144
-          # rendered-char managed-policy cap.
           "secretsmanager:PutSecretValue"
         ]
         Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork/*"
@@ -119,13 +101,6 @@ locals {
           "${var.bucket_arn}/*",
         ]
       },
-      # (was inline policy "wiki-exports-s3" in handlers.tf) — wiki-export
-      # writes markdown vault bundles to the per-stage wiki-exports bucket.
-      {
-        Effect   = "Allow"
-        Action   = ["s3:PutObject", "s3:AbortMultipartUpload"]
-        Resource = "${aws_s3_bucket.wiki_exports.arn}/*"
-      },
       # Canonical ThinkWork Brain artifacts: durable source artifacts,
       # ingestion manifests, migration snapshots, vault projections, and
       # exports, and OKF Wiki Navigator bundles/current manifests.
@@ -181,6 +156,8 @@ locals {
           "cognito-idp:AdminRespondToAuthChallenge",
           "cognito-idp:AdminSetUserPassword",
           "cognito-idp:AdminUpdateUserAttributes",
+          "cognito-idp:DescribeIdentityProvider",
+          "cognito-idp:DescribeUserPoolClient",
           "cognito-idp:ListUsers",
         ]
         Resource = var.user_pool_arn
@@ -322,17 +299,25 @@ locals {
         Resource = var.plugin_catalog_github_token_secret_arn
       },
     ] : [],
-    # THINK-229 U1 — analyst-query-broker mints RDS IAM auth tokens for the
-    # analyst_reader role. The rds-db ARN keys on the immutable cluster
-    # RESOURCE ID (cluster-XXXX), never the cluster ARN, and the dbuser
-    # segment is the exact-case Postgres role name. aws:SourceIp /
-    # aws:SourceVpc conditions are unsupported on rds-db:connect, so the
-    # narrow Resource IS the control surface.
-    var.analyst_db_cluster_resource_id != "" ? [
+    # Company Brain machine lane (THINK-628): MCP config build mints Cognito
+    # client-credentials bearers from this one secret instead of reading a
+    # stored tkt_ token. Read-only, one exact ARN, count-gated: an account
+    # that never sets the var plans to zero changes.
+    var.brain_m2m_platform_agent_secret_arn != "" ? [
       {
         Effect   = "Allow"
-        Action   = ["rds-db:connect"]
-        Resource = "arn:aws:rds-db:${var.region}:${var.account_id}:dbuser:${var.analyst_db_cluster_resource_id}/analyst_reader"
+        Action   = ["secretsmanager:GetSecretValue"]
+        Resource = var.brain_m2m_platform_agent_secret_arn
+      },
+    ] : [],
+    # Brain ops-api agent identity (THINK-781): flagThreadToBrain mints a
+    # bearer from this secret to POST /flags. Same posture as the machine
+    # lane above — read-only, one exact ARN, count-gated.
+    var.brain_ops_m2m_secret_arn != "" ? [
+      {
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue"]
+        Resource = var.brain_ops_m2m_secret_arn
       },
     ] : [],
     # (was standalone managed policy "lambda_deployment_evidence_read")
@@ -346,6 +331,7 @@ locals {
     # refresh path cannot replace the old manual AWS CLI step.
     var.deployment_evidence_bucket != "" ? [
       {
+        Sid    = "DeploymentEvidenceBucket"
         Effect = "Allow"
         Action = [
           "s3:GetObject",
@@ -357,6 +343,12 @@ locals {
           "arn:aws:s3:::${var.deployment_evidence_bucket}/*",
         ]
       },
+      {
+        Sid      = "AgentCoreHarnessGatewayOauthSecret"
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue"]
+        Resource = ["arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:bedrock-agentcore-identity!default/oauth2/thinkwork-${var.stage}-proof-oauth-*"]
+      },
     ] : [],
     var.billing_export_bucket_name != "" ? [
       {
@@ -388,33 +380,33 @@ locals {
         )
       },
     ] : [],
-    var.brain_artifacts_kms_key_arn != "" ? [
+    # THINK-585 U6: the dispatcher's on-failure destination (Lambda sends
+    # with the function's execution role) + the redrive consumer's ESM
+    # polling, both on the agentcore-dispatch DLQ.
+    local.deploy_lambda_handlers ? [
       {
         Effect = "Allow"
         Action = [
-          "kms:Decrypt",
-          "kms:GenerateDataKey",
+          "sqs:SendMessage",
+          "sqs:ReceiveMessage",
+          "sqs:DeleteMessage",
+          "sqs:GetQueueAttributes",
+          "sqs:ChangeMessageVisibility",
         ]
-        Resource = var.brain_artifacts_kms_key_arn
-        Condition = {
-          StringEquals = {
-            "kms:ViaService" = "s3.${var.region}.amazonaws.com"
-          }
-        }
+        Resource = [for q in aws_sqs_queue.agentcore_dispatch_dlq : q.arn]
       },
     ] : [],
-    var.okf_efs_file_system_arn != "" && var.okf_efs_refresh_access_point_arn != "" ? [
+    var.brain_artifacts_kms_key_arn != "" ? [
       {
-        Sid    = "OkfEfsHydratorMountWrite"
         Effect = "Allow"
         Action = [
-          "elasticfilesystem:ClientMount",
-          "elasticfilesystem:ClientWrite",
+          "kms:Decrypt",
+          "kms:GenerateDataKey",
         ]
-        Resource = var.okf_efs_file_system_arn
+        Resource = var.brain_artifacts_kms_key_arn
         Condition = {
           StringEquals = {
-            "elasticfilesystem:AccessPointArn" = var.okf_efs_refresh_access_point_arn
+            "kms:ViaService" = "s3.${var.region}.amazonaws.com"
           }
         }
       },
@@ -435,13 +427,36 @@ locals {
         Resource = var.capability_broker_session_table_arn
       },
     ] : [],
+    # THINK-643 — auth-subscription-ticket mints tickets and bumps the connect
+    # counter; appsync-subscription-authorizer reads and conditionally consumes
+    # them. Both run on this shared role. Empty (→ no grant) while
+    # auth_state_store is "postgres", so the grant appears with the table.
+    #
+    # THINK-644 adds the `webhooks` handler (idempotency receipts) as a third
+    # consumer. It needs no separate statement: every handler in the
+    # aws_lambda_function.api for_each runs on aws_iam_role.lambda — the sole
+    # exception is memory-retraction-drainer, which does not touch this table.
+    # A future consumer on a sibling role would need its own grant.
+    local.auth_state_enabled ? [
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:Query",
+        ]
+        Resource = aws_dynamodb_table.auth_state[0].arn
+      },
+    ] : [],
   )
 
   # ---------------------------------------------------------------------------
   # Group 2: orchestration — cross-function invokes, Scheduler, Step
   # Functions, SQS, SES.
   # ---------------------------------------------------------------------------
-  api_orchestration_statements = concat(
+  api_orchestration_candidate_statements = concat(
     [
       # (was inline policy "ses-send")
       # SES send permissions for the email-send handler. Scoped to any
@@ -491,52 +506,45 @@ locals {
       # (was inline policy "api-cross-function-invoke")
       # Allow API handler Lambdas to invoke each other directly. sendMessage
       # dispatches to chat-agent-invoke for instant chat response; the memory
-      # resolvers reach knowledge-base-manager and job-schedule-manager for
-      # admin-driven operations. The agentcore-invoke statement below covers
+      # resolvers reach job-schedule-manager for
+      # admin-driven operations. The Pi-invoke statement below covers
       # the Pi runtime Lambda only — this one covers internal api-to-api
       # calls. ARNs are constructed deterministically from the handler naming
       # pattern so we don't create a dependency cycle with the handler
       # resource.
       {
+        Sid    = "ApiCrossFunctionInvoke"
         Effect = "Allow"
         Action = ["lambda:InvokeFunction"]
         Resource = [
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-chat-agent-invoke",
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-base-manager",
+          # THINK-583 U3: invokers address the `live` alias (provisioned
+          # concurrency only serves alias-qualified invokes); the alias ARN
+          # is a distinct IAM resource from the unqualified function ARN.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-chat-agent-invoke:live",
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-job-schedule-manager",
           # eval-runner: graphql-http's startEvalRun mutation Event-invokes
           # this asynchronously after inserting the eval_runs row.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-eval-runner",
-          # wiki-compile: memory-retain Event-invokes this after a successful
-          # retainTurn when the tenant's wiki_compile_enabled flag is on.
-          # compileWikiNow admin mutation also Event-invokes.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-compile",
-          # knowledge-graph-observations-ingest: graphql-http's
-          # startKnowledgeGraphObservationsIngest mutation invokes this with
-          # RequestResponse, and memory-stage-worker's graph stage (THINK-193
-          # U4 stitch) RequestResponse-invokes it with a targeted bankIds
-          # payload — the Bedrock classifier/extraction model config lives on
-          # the ingest Lambda's own env, so the worker never runs the ingest
-          # in-process. (The worker's self-invoke drain is retired — AWS
-          # recursive-loop detection terminated those chains; backlog drains
-          # in-process now.)
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-graph-observations-ingest",
-          # wiki-bootstrap-import: bootstrapJournalImport admin mutation
-          # Event-invokes this for the long-running ingest path.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-bootstrap-import",
-          # ontology-scan: startOntologySuggestionScan Event-invokes this
-          # after inserting a durable scan job row.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-scan",
-          # ontology-reprocess: approveOntologyChangeSet Event-invokes this
-          # after inserting a durable reprocess job row.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-reprocess",
-          # okf-materialize / okf-efs-refresh: the OKF distribution chain
-          # (THINK-200). wiki-compile Event-invokes okf-materialize after a
-          # successful compile; okf-materialize Event-invokes okf-efs-refresh
-          # after publishing bundles, keeping the Pi wiki navigator's EFS
-          # view current without manual invocation.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-okf-materialize",
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-okf-efs-refresh",
+          # identity-graph-projector (Company Brain U5): identity mutations
+          # Event-invoke this as a post-commit nudge; the rebuild command is
+          # a RequestResponse invoke. Cursor makes missed nudges harmless.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-identity-graph-projector",
+          # harness-runner: chat-agent-invoke Event-invokes this for chat
+          # turns routed to the AWS AgentCore runtime (THINK-311 trial).
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-harness-runner",
+          # harness-runner queues the same canonical post-turn memory pipeline
+          # as Pi after a completed AgentCore turn. The retain ledger makes the
+          # Event invoke idempotent on the thread-turn source key.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-memory-retain",
+          # harness-runner RequestResponse-invokes this dedicated signer. The
+          # signer re-derives the actor/tenant/thread tuple from the running
+          # turn and alone holds KMS Sign; the shared runner role never does.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-turn-assertion-mint",
+          # identity-match (THINK-321 U7): startIdentityMatchJob Event-invokes
+          # this after inserting a durable match job row; identity-match also
+          # self-invokes for the continuation chain (same shared role).
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-identity-match",
           # routine-resume: routine-approval-bridge (Phase B U8) invokes
           # this with RequestResponse after a HITL decideInboxItem
           # decision. Calls SendTaskSuccess/SendTaskFailure on the SFN
@@ -548,7 +556,9 @@ locals {
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-workspace-files-efs",
           # workspace-renderer: chat-agent-invoke invokes this synchronously
           # before AgentCore so Pi can opt into the rendered
-          # per-(agent, Space, user) workspace prefix.
+          # per-(agent, Space, user) workspace prefix. THINK-583 U3: the
+          # `:live` alias ARN is covered by the dedicated workspace-renderer
+          # statement below (`...workspace-renderer:*`).
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-workspace-renderer",
           # skill-trust-runner: graphql-http's publishSkillDraft mutation
           # invokes this with RequestResponse so SkillSpector completion is a
@@ -594,6 +604,9 @@ locals {
         Resource = [
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-workspace-renderer",
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-workspace-renderer:*",
+          # THINK-585 U6: chat-agent-invoke Event-invokes the runtime
+          # dispatcher at the flag-on dispatch seam.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-agentcore-runtime-dispatch",
         ]
       },
       # (was standalone managed policy "thread_idle_memory_learning_invoke")
@@ -761,11 +774,35 @@ locals {
     ] : [],
   )
 
+  # Internal Lambda invocation is intentionally partitioned from the remaining
+  # orchestration grants. The generated resource list grows with API features
+  # and can otherwise push the shared orchestration managed policy beyond
+  # IAM's hard 6,144-character document limit. Both partitions remain attached
+  # to the same shared Lambda role and are covered by the size assertion below.
+  api_orchestration_statements = [
+    for statement in local.api_orchestration_candidate_statements : statement
+    if !contains(try(statement.Action, []), "lambda:InvokeFunction")
+  ]
+  api_invocation_statements = [
+    for statement in local.api_orchestration_candidate_statements : statement
+    if contains(try(statement.Action, []), "lambda:InvokeFunction")
+  ]
+
   # ---------------------------------------------------------------------------
-  # Group 3: AI — Bedrock model invocation, Knowledge Bases, AgentCore
+  # Group 3: AI — Bedrock model invocation, AgentCore
   # memory / evaluations / code interpreter.
   # ---------------------------------------------------------------------------
   api_ai_statements = concat([
+    # Signed-turn identity (THINK-324 C18): dispatch Lambdas mint with
+    # kms:Sign; verifiers fetch the public key once per container with
+    # kms:GetPublicKey. Scoped to the turn-assertion keys only; the role is
+    # shared, so which handler may mint is code-enforced.
+    {
+      Sid      = "TurnAssertionSigning"
+      Effect   = "Allow"
+      Action   = ["kms:Sign", "kms:GetPublicKey"]
+      Resource = local.turn_assertion_key_arns
+    },
     # (was inline policy "bedrock-invoke")
     # Cross-region inference profiles (us.anthropic.claude-*) require
     # `bedrock:InvokeModel` on the *inference-profile* ARN AND on the
@@ -781,62 +818,17 @@ locals {
         "arn:aws:bedrock:*:${var.account_id}:inference-profile/*",
       ]
     },
-    # (was standalone managed policy "lambda_bedrock_knowledge_base")
-    # The knowledge-base-manager Lambda provisions and manages Bedrock
-    # Knowledge Bases (control plane: create/sync/rechunk/delete), and
-    # graphql-http's testKnowledgeBaseRetrieval query calls Retrieve. Without
-    # these the manager fails with "not authorized to perform:
-    # bedrock:CreateKnowledgeBase" and every KB is stuck in `failed`.
-    # CreateKnowledgeBase / CreateDataSource also take a roleArn that Bedrock
-    # assumes, so the caller needs iam:PassRole on the KB service role.
-    {
-      Effect = "Allow"
-      Action = [
-        "bedrock:CreateKnowledgeBase",
-        "bedrock:GetKnowledgeBase",
-        "bedrock:UpdateKnowledgeBase",
-        "bedrock:DeleteKnowledgeBase",
-        "bedrock:ListKnowledgeBases",
-        "bedrock:CreateDataSource",
-        "bedrock:GetDataSource",
-        "bedrock:UpdateDataSource",
-        "bedrock:DeleteDataSource",
-        "bedrock:ListDataSources",
-        "bedrock:StartIngestionJob",
-        "bedrock:GetIngestionJob",
-        "bedrock:ListIngestionJobs",
-        "bedrock:Retrieve",
-        # THINK-193 U7: knowledge-base-manager reconciles the per-document
-        # manifest after successful syncs (List/Get) and gates deletion
-        # settlement on Get + the scoped Retrieve above. Ingest/Delete cover
-        # the explicit direct-delete path for S3 RETAIN'd documents — the
-        # manager never races them with StartIngestionJob. The workspace-
-        # bucket S3 read the memory-stage-worker needs for document text is
-        # already granted by the shared role's workspace "s3-access"
-        # statement (data-plane group).
-        "bedrock:ListKnowledgeBaseDocuments",
-        "bedrock:GetKnowledgeBaseDocuments",
-        "bedrock:IngestKnowledgeBaseDocuments",
-        "bedrock:DeleteKnowledgeBaseDocuments",
-      ]
-      # CreateKnowledgeBase/CreateDataSource have no resource ARN at create
-      # time and don't support resource-level scoping, so a knowledge-base/*
-      # ARN makes the grant not match. Control-plane "*" for this internal
-      # manager Lambda; PassRole below stays scoped to the KB service role.
-      Resource = "*"
-    },
-    {
-      Effect   = "Allow"
-      Action   = ["iam:PassRole"]
-      Resource = var.kb_service_role_arn != "" ? var.kb_service_role_arn : "*"
-    },
     # (was inline policy "agentcore-memory-rw")
-    # AgentCore Memory read access for the GraphQL memory resolvers.
-    # memoryRecords / memorySearch call ListMemoryRecordsCommand to fetch
-    # records across the tenant's agents.
+    # AgentCore Memory access for the GraphQL memory resolvers and the
+    # memory-retain handler. memoryRecords / memorySearch call
+    # ListMemoryRecordsCommand to fetch records across the tenant's agents;
+    # memory-retain calls CreateEventCommand to land the turn in the managed
+    # memory (before the agentcore engine flip that write went to Hindsight
+    # over HTTP, so no IAM action existed for it).
     {
       Effect = "Allow"
       Action = [
+        "bedrock-agentcore:CreateEvent",
         "bedrock-agentcore:ListMemoryRecords",
         "bedrock-agentcore:RetrieveMemoryRecords",
         "bedrock-agentcore:GetMemoryRecord",
@@ -887,73 +879,38 @@ locals {
       Resource = "*"
     },
     ],
-    # THINK-311 U4 — AgentCore Harness trial invoker grants, present only when
-    # the agentcore-harness module is enabled (empty role ARN = module off).
-    # Ship-inert: no handler calls Harness until U5's harness-runner lands.
-    #
-    # CRITICAL: never grant `bedrock-agentcore:InvokeAgentRuntimeCommand`
-    # anywhere — it bypasses Harness allowedTools enforcement. Invocation goes
-    # through InvokeHarness / InvokeAgentRuntime only.
-    var.agentcore_harness_execution_role_arn != "" ? [
+    # THINK-324 — the managed-harness invoke grant is retired. The AgentCore
+    # Identity chain below survives UNCONDITIONALLY: the live Twenty
+    # connector's per-user 3LO (handlers/skills.ts via
+    # lib/agentcore-identity/agentcore-user-oauth.ts) mints workload tokens
+    # against the shared workload identity and reads the twenty-crm
+    # credential provider from the token vault.
+    [
       {
-        # Data plane — invoke a Harness (and its runtime endpoints) directly.
-        Sid    = "AgentCoreHarnessInvoke"
+        Sid    = "AgentCoreTwentyIdentity"
         Effect = "Allow"
         Action = [
-          "bedrock-agentcore:InvokeHarness",
-          "bedrock-agentcore:InvokeAgentRuntime",
+          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+          "bedrock-agentcore:GetWorkloadAccessTokenForUserId",
+          "bedrock-agentcore:GetResourceOauth2Token",
+          "bedrock-agentcore:CompleteResourceTokenAuth",
         ]
-        Resource = "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:harness/*"
-      },
-      {
-        # Control plane — CreateHarness has no resource ARN at create time
-        # (same non-scopable shape as bedrock:CreateKnowledgeBase above), so
-        # this statement is "*"; PassRole below stays scoped to the single
-        # Harness execution role.
-        Sid    = "AgentCoreHarnessControl"
-        Effect = "Allow"
-        Action = [
-          "bedrock-agentcore:CreateHarness",
-          "bedrock-agentcore:GetHarness",
-          "bedrock-agentcore:UpdateHarness",
-          "bedrock-agentcore:DeleteHarness",
-          "bedrock-agentcore:CreateHarnessEndpoint",
-          "bedrock-agentcore:GetHarnessEndpoint",
-          "bedrock-agentcore:ListHarnessEndpoints",
-          "bedrock-agentcore:ListHarnesses",
-          "bedrock-agentcore:ListHarnessVersions",
+        Resource = [
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default/workload-identity/thinkwork-${var.stage}-multiplayer-proof",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default/oauth2credentialprovider/thinkwork-${var.stage}-twenty-crm",
         ]
-        Resource = "*"
       },
-    ] : [],
-    # (Separate conditional from the two statements above only because the
-    # Condition attribute gives this object a different Terraform type —
-    # same gate, same feature.)
-    var.agentcore_harness_execution_role_arn != "" ? [
-      {
-        # CreateHarness takes executionRoleArn; the caller must be able to
-        # pass exactly that role, and only to the bedrock-agentcore service.
-        Sid      = "AgentCoreHarnessPassExecutionRole"
-        Effect   = "Allow"
-        Action   = ["iam:PassRole"]
-        Resource = var.agentcore_harness_execution_role_arn
-        Condition = {
-          StringEquals = {
-            "iam:PassedToService" = "bedrock-agentcore.amazonaws.com"
-          }
-        }
-      },
-    ] : [],
+    ],
   )
 
   # ---------------------------------------------------------------------------
   # Group 4: observability — CloudWatch Logs reads, ECS/ALB health reads.
   # ---------------------------------------------------------------------------
-  # Handler-gated SQS grants moved HERE from the data-plane group
-  # (THINK-229 U5 follow-up): data-plane hit IAM's 6,144-char rendered cap
-  # when the analyst-connection-reconciler DLQ grant landed (live size was
-  # 6,018 before it). Queue plumbing is operational surface; observability
-  # has ~5k headroom. Same statements, different envelope.
+  # Handler-gated SQS grants live HERE rather than in the data-plane group:
+  # data-plane sits near IAM's 6,144-char rendered cap. Queue plumbing is
+  # operational surface; observability has ~5k headroom.
   api_observability_sqs_statements = concat(
     # SQS grants live here rather than in the orchestration group purely for
     # size balance: with every conditional on, orchestration's rendered JSON
@@ -961,26 +918,12 @@ locals {
     # Handler-gated SQS grants. Each statement was a count-gated inline
     # policy whose queue exists only when local.deploy_lambda_handlers.
     local.deploy_lambda_handlers ? [
-      # (was inline policy "thinkwork-${stage}-wiki-compile-dlq-send")
-      {
-        Sid      = "WikiCompileDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.wiki_compile_dlq[0].arn
-      },
-      # (was inline policy "thinkwork-${stage}-ontology-scan-dlq-send")
+      # THINK-321 U7 identity-match async-failure DLQ.
       {
-        Sid      = "OntologyScanDlqSend"
+        Sid      = "IdentityMatchDlqSend"
         Effect   = "Allow"
         Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.ontology_scan_dlq[0].arn
-      },
-      # (was inline policy "thinkwork-${stage}-ontology-reprocess-dlq-send")
-      {
-        Sid      = "OntologyReprocessDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.ontology_reprocess_dlq[0].arn
+        Resource = aws_sqs_queue.identity_match_dlq[0].arn
       },
       # (was inline policy "compliance-drainer-dlq-send")
       {
@@ -989,13 +932,6 @@ locals {
         Action   = ["sqs:SendMessage"]
         Resource = aws_sqs_queue.compliance_drainer_dlq[0].arn
       },
-      # THINK-229 U5 — analyst-connection-reconciler async on_failure DLQ.
-      {
-        Sid      = "AnalystConnectionReconcilerDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.analyst_connection_reconciler_dlq[0].arn
-      },
       # (was inline policy "compliance-exports-send")
       # graphql-http needs sqs:SendMessage on the exports queue to dispatch
       # jobIds from the createComplianceExport mutation. Attached to the
@@ -1037,9 +973,102 @@ locals {
         Resource = aws_sqs_queue.eval_fanout_dlq[0].arn
       },
     ] : [],
+    # Company Brain twin (plan 2026-07-21-001 U5): Neptune data access for
+    # the identity-graph-projector (and the wiki-compile soft-layer writer)
+    # on the SHARED role. The twin-query read Lambda and its dedicated
+    # read-only role retired to the platform service (THINK-339 U15) — no
+    # caller-supplied query path remains product-side.
+    # Lives in the ai envelope for size balance (data-plane sits ~430 chars
+    # under IAM's 6,144 cap). Grouped — not inline — so the no-terraform
+    # targeted deploy path (which applies exactly these grouped policies)
+    # self-heals the grant; the original inline resource never survived a
+    # superseded full apply. Data actions are condition-pinned to openCypher,
+    # mirroring the etl-side policies.
+    # (Two segments, not one: the data statement carries a Condition the
+    # status statement can't — mixed shapes in one conditional tuple fail
+    # Terraform's type unification.)
+    var.neptune_cluster_resource_id == "" ? [] : [
+      {
+        Sid    = "TwinNeptuneData"
+        Effect = "Allow"
+        Action = [
+          "neptune-db:ReadDataViaQuery",
+          "neptune-db:WriteDataViaQuery",
+          "neptune-db:DeleteDataViaQuery",
+        ]
+        Resource = "arn:aws:neptune-db:${var.region}:${var.account_id}:${var.neptune_cluster_resource_id}/*"
+        Condition = {
+          StringEquals = { "neptune-db:QueryLanguage" = "OpenCypher" }
+        }
+      },
+    ],
+    var.neptune_cluster_resource_id == "" ? [] : [
+      {
+        Sid      = "TwinEngineStatus"
+        Effect   = "Allow"
+        Action   = ["neptune-db:GetEngineStatus", "neptune-db:GetGraphSummary"]
+        Resource = "arn:aws:neptune-db:${var.region}:${var.account_id}:${var.neptune_cluster_resource_id}/*"
+      },
+    ],
+    # Bulk-rebuild lane (THINK-331 U4): the projector stages openCypher CSVs
+    # under the tenant-scoped thinkwork-identity/ prefix of the etl-platform
+    # load bucket (Put for upload, Delete for the terminal-state cleanup)
+    # and drives the loader job API. The CSVs are streamed as S3 multipart
+    # uploads for large tenants (THINK-409): CreateMultipartUpload /
+    # UploadPart / CompleteMultipartUpload all authorize as s3:PutObject, and
+    # the failure path's AbortMultipartUpload is the action below — no
+    # s3:ListMultipartUploadParts needed, the stager tracks its own parts
+    # (this policy is near IAM's 6,144-char cap; see below). A NEW statement
+    # group — the existing
+    # TwinNeptuneData statement is condition-pinned to QueryLanguage=
+    # OpenCypher, which the loader actions don't satisfy. Gated on the
+    # bulk-loader variables so stages without the twin stack ship inert
+    # (KTD-9). No iam:PassRole needed: the loader role is assumed by the
+    # Neptune service via its cluster association, not passed by this role.
+    var.neptune_load_bucket == "" || var.neptune_loader_role_arn == "" || var.neptune_cluster_resource_id == "" ? [] : [
+      {
+        Sid      = "TwinBulkLoaderStage"
+        Effect   = "Allow"
+        Action   = ["s3:PutObject", "s3:AbortMultipartUpload", "s3:DeleteObject"]
+        Resource = "arn:aws:s3:::${var.neptune_load_bucket}/thinkwork-identity/*"
+      },
+      {
+        Sid      = "TwinBulkLoaderJobs"
+        Effect   = "Allow"
+        Action   = ["neptune-db:StartLoaderJob", "neptune-db:GetLoaderJobStatus", "neptune-db:CancelLoaderJob"]
+        Resource = "arn:aws:neptune-db:${var.region}:${var.account_id}:${var.neptune_cluster_resource_id}/*"
+      },
+    ],
   )
 
   api_observability_statements = concat(local.api_observability_sqs_statements, [
+    # Backend notification publishing is IAM-only. Scope the shared API
+    # execution role to the NONE-resolver mutation fields; end-user identity-
+    # pool credentials have no AppSync grant. This statement lives in the
+    # observability envelope for size balance: adding subscription invalidation
+    # pushed the data-plane policy over IAM's 6,144-character hard cap.
+    {
+      Sid    = "PublishAppSyncNotifications"
+      Effect = "Allow"
+      Action = ["appsync:GraphQL"]
+      Resource = [
+        for field in [
+          "notifyAgentStatus",
+          "notifyNewMessage",
+          "notifyHeartbeatActivity",
+          "notifyThreadActivity",
+          "notifyThreadUpdate",
+          "notifyInboxItemUpdate",
+          "notifyThreadTurnUpdate",
+          "notifyThreadTurnStep",
+          "notifyOrgUpdate",
+          "notifyCostRecorded",
+          "notifyEvalRunUpdate",
+          "notifyWorkspaceAccessRevoked",
+          "invalidateSubscription",
+        ] : "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}/types/Mutation/fields/${field}"
+      ]
+    },
     # (was inline policy "cloudwatch-logs-read")
     {
       Effect = "Allow"
@@ -1083,16 +1112,52 @@ locals {
       Resource = "*"
     },
   ])
+
+  api_grouped_policy_documents = {
+    data_plane = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_data_plane_statements
+    })
+    orchestration = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_orchestration_statements
+    })
+    invocation = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_invocation_statements
+    })
+    ai = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_ai_statements
+    })
+    observability = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_observability_statements
+    })
+  }
+}
+
+check "api_grouped_managed_policy_sizes" {
+  assert {
+    condition = alltrue([
+      for document in values(local.api_grouped_policy_documents) : length(document) <= 6144
+    ])
+    error_message = "Each grouped API managed-policy document must remain within AWS IAM's 6,144-character limit."
+  }
 }
 
 resource "aws_iam_policy" "api_data_plane" {
   name        = "thinkwork-${var.stage}-api-data-plane"
   description = "Grouped data-plane grants (RDS Data API, Secrets Manager, S3, DynamoDB, Cognito, SSM, KMS-via-SSM, SQS) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_data_plane_statements
-  })
+  policy = local.api_grouped_policy_documents.data_plane
+
+  lifecycle {
+    precondition {
+      condition     = length(local.api_grouped_policy_documents.data_plane) <= 6144
+      error_message = "The grouped API data-plane managed-policy document exceeds AWS IAM's 6,144-character limit."
+    }
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "api_data_plane" {
@@ -1102,12 +1167,27 @@ resource "aws_iam_role_policy_attachment" "api_data_plane" {
 
 resource "aws_iam_policy" "api_orchestration" {
   name        = "thinkwork-${var.stage}-api-orchestration"
-  description = "Grouped orchestration grants (Lambda invoke, EventBridge Scheduler, Step Functions, SES) for the shared api Lambda role"
+  description = "Grouped orchestration grants (EventBridge Scheduler, Step Functions, SES) for the shared api Lambda role"
+
+  policy = local.api_grouped_policy_documents.orchestration
+
+  # Attach the replacement invoke grant before removing it from this policy.
+  # This preserves Lambda-to-Lambda access if an apply stops between updates.
+  depends_on = [aws_iam_role_policy_attachment.api_invocation]
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_orchestration_statements
-  })
+  lifecycle {
+    # Existing environments may retain the historical description that also
+    # mentioned Lambda invocation. Description changes replace IAM managed
+    # policies, which would destroy the old orchestration grant before the new
+    # invocation attachment is ready. Keep the policy identity stable so the
+    # depends_on edge above orders an in-place document update after attach.
+    ignore_changes = [description]
+
+    precondition {
+      condition     = length(local.api_grouped_policy_documents.orchestration) <= 6144
+      error_message = "The grouped API orchestration managed-policy document exceeds AWS IAM's 6,144-character limit."
+    }
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "api_orchestration" {
@@ -1115,14 +1195,37 @@ resource "aws_iam_role_policy_attachment" "api_orchestration" {
   policy_arn = aws_iam_policy.api_orchestration.arn
 }
 
+resource "aws_iam_policy" "api_invocation" {
+  name        = "thinkwork-${var.stage}-api-invocation"
+  description = "Internal Lambda invocation grants for the shared api Lambda role"
+
+  policy = local.api_grouped_policy_documents.invocation
+
+  lifecycle {
+    precondition {
+      condition     = length(local.api_grouped_policy_documents.invocation) <= 6144
+      error_message = "The grouped API invocation managed-policy document exceeds AWS IAM's 6,144-character limit."
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "api_invocation" {
+  role       = aws_iam_role.lambda.name
+  policy_arn = aws_iam_policy.api_invocation.arn
+}
+
 resource "aws_iam_policy" "api_ai" {
   name        = "thinkwork-${var.stage}-api-ai"
-  description = "Grouped AI grants (Bedrock invoke, Knowledge Bases, AgentCore memory/eval/code-interpreter) for the shared api Lambda role"
+  description = "Grouped AI grants (Bedrock invoke, AgentCore memory/eval/code-interpreter) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_ai_statements
-  })
+  policy = local.api_grouped_policy_documents.ai
+
+  lifecycle {
+    precondition {
+      condition     = length(local.api_grouped_policy_documents.ai) <= 6144
+      error_message = "The grouped API AI managed-policy document exceeds AWS IAM's 6,144-character limit."
+    }
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "api_ai" {
@@ -1134,10 +1237,14 @@ resource "aws_iam_policy" "api_observability" {
   name        = "thinkwork-${var.stage}-api-observability"
   description = "Grouped observability grants (CloudWatch Logs reads, ECS/ALB health reads) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_observability_statements
-  })
+  policy = local.api_grouped_policy_documents.observability
+
+  lifecycle {
+    precondition {
+      condition     = length(local.api_grouped_policy_documents.observability) <= 6144
+      error_message = "The grouped API observability managed-policy document exceeds AWS IAM's 6,144-character limit."
+    }
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "api_observability" {
@@ -1176,3 +1283,5 @@ moved {
   from = aws_iam_role_policy_attachment.lambda_bedrock_knowledge_base
   to   = aws_iam_role_policy_attachment.api_ai
 }
+
+