Production readiness — Section 3: Identity, Authentication, and Permissions
Real build work, deferred per the doc-first sweep. Needed: AWS IAM Identity Center with separate Gabriel/Aaron identities and permission sets, replacing the shared musehub-infra laptop credential with individual or CI-scoped temporary credentials.
Blocked on: broader AWS read access (requested from Gabriel) to audit current IAM state fully before designing the target shape.
Reviewed with full detail (03-identity-and-permissions.md + runbook-deploy-onboarding.md).
Human Access — done for Gabriel/Aaron (2026-08-26): IAM Identity Center is live (MuseHub-Workforce, Google Workspace SAML + SCIM). Gabriel and Aaron each have individual identities with AdministratorAccess across all three AWS accounts (Management, Nonproduction, Production). This deliberately supersedes the original scoped Operator + production-approval-gate plan for Aaron — Gabriel upgraded it given Aaron's 50/50 LLC ownership stake and intent to independently own half of infra maintenance.
Deferred, not forgotten: Sol/Toby/Ben's StagingOperator access remains intentionally out of scope — no active timeline for any of them starting yet. Revisit when one of them is actually about to contribute.
Still open (separate from this ticket's human-access scope): the shared musehub-infra long-lived credential is still what deploy/push.sh/deploy/deploy.sh use, and those scripts are still hardcoded to the old pre-rebuild instance. That's tracked under #159.
Also fixed a stale note in the runbook claiming prod deploy was blocked by a missing IAM instance profile on the old instance — that instance no longer exists; production was rebuilt from scratch with a correctly configured instance profile.
Leaving open pending the #159 deploy-credential work.
Scope update: this section's IAM Identity Center rollout should cover all 5 team members from the start (Gabriel, Aaron, Sol, Toby, Ben), not just Gabriel/Aaron. Target permission sets: Administrator (Gabriel), Operator (Aaron), StagingOperator (interns, staging-only). See docs/production-readiness/runbook-deploy-onboarding.md.