# Adoption: learning_ai_auth_app (SmartAuth)

> **Status:** Planned hardening adopter
> **Owner:** `learning_ai_auth_app` (formerly split across `learning_ai_smart_auth` + `learning_ai_auth_app` — merged May 2026)
> **Ecosystem focus:** identity trust signals + approval capture + decision confirmation + trust-aware action authorization

---

## Goals

- expose identity trust state through shared ecosystem trust semantics
- provide reusable step-up decisions to runtime consumers and other products
- provide one approval UX for agent, auth, and destructive-action decisions
- consume canonical approval payloads rather than product-specific prompts
- preserve approval lineage for ActionTrail and runtime replay
- avoid product-local approval policy forks

## Expected Contract Touchpoints

- `ECOSYSTEM_APPROVALS_AND_TRUST_MODEL.md`
- `ECOSYSTEM_EVENT_TAXONOMY.md`
- `ECOSYSTEM_AGENT_RUNTIME_CONTRACT.md`

## Planned Adoption Scope

### Identity & Trust (SmartAuth backend in platform-service)

- map SmartAuth identity posture into canonical trust levels
- emit trust-related events without leaking provider-specific auth details
- provide reusable approval prerequisites to Cowork, FlowMonk, and future agent products
- support approval reuse decisions based on identity trust state

### Approval UX (Auth companion app)

- consume canonical approval records and shared approval prompt metadata
- support session-scoped and run-scoped approval reuse windows
- render why an approval is required using trust and risk inputs
- emit approval decision events in the canonical event family

## Verification Checklist

- [ ] identity trust levels map cleanly into the shared taxonomy
- [ ] step-up-required cases are emitted or exposed consistently
- [ ] approval consumers can evaluate SmartAuth trust state without provider-specific logic
- [ ] approval payload renders without product-specific branching
- [ ] approval decisions map into canonical approval events
- [ ] approval reuse, expiry, and denial states are visible to downstream consumers
- [ ] tracker updated with implementation commit links

## Risks

- auth-provider-specific signals may not map cleanly into one canonical trust model
- over-sharing auth internals would create security and privacy risk
- approval UX may become too generic unless action-specific context is preserved
- stale approval decisions would be dangerous if expiry and reuse rules are weak

## Commits

- `065c025` added this adoption plan (originally split across smart_auth + auth_app)
- May 2026: merged the two adopter docs after consolidating `learning_ai_smart_auth` into `learning_ai_auth_app`
