4. Trust Players for Now, Defer Zero Trust

Why players are trusted not to spoof each other’s intents, how the code of conduct covers this, and how zero trust could be added later.
  • Status: accepted
  • Date: 2025-09-05
  • Deciders: Jannik Alexander, Stefan Bente, Daniel Köllgen (governance board)

Context

Players send intents as Kafka events (ADR-0002), and core services publish their events globally. In our Kafka setup, nothing stops a player from reading every event or from publishing intents in another player’s name — for example, moving another player’s robots.

In the long run the board wants players treated as services in a “zero trust” sense, as in a production landscape. But implementing a player must stay accessible for ordinary developers, students and two-day event participants, and a security concept must not dominate the learning experience or the core team’s effort.

Decision

  • Core services MUST treat intents as coming from the player they name. There is no technical check of the sender.
  • The code of conduct applies to every player:
    • Reading all events of the core services is allowed. There is no fog of war — the full map and all other players' activities are intended to be visible.
    • Cheating is not allowed, in particular sending intents in another player’s name.
  • Access to the REST APIs of the core services is handled by an API key, handed to players on deployment.

Alternatives

  • Commands via REST, authenticated with Keycloak — rejected for now because it reverses ADR-0002 and requires identity management for every player.
  • Signed intent events — rejected for now because key management and signature checks add a lot of complexity for players and services, and are unproven in our setup.

Consequences

  • Good: players publish and consume events with a plain Kafka client, without tokens or signatures.
  • Good: less for the core team to build, operate and explain.
  • Good: full visibility of events allows a simple full-map data structure in players.
  • Bad: spoofing is prevented only socially. In an unsupervised setting (e.g. an open, self-service leaderboard) the agreement cannot be enforced.
  • Bad: the game loses the strategic element of fog of war.
Last modified October 22, 2026: Update documentation (f481966)