qualify

How it works

qualify is the people layer of the Provabl suite. It sits between identity and access — training completion is the gate.

# Tags written by qualify on CUI training completion:
attest:cui-training=true
attest:cui-training-expiry=2027-04-29T00:00:00Z
attest:lab-id=chen-quantum-lab

# Cedar policy in attest (compiled from framework):
permit(
  principal,
  action == Action::"s3:GetObject",
  resource in ResourceGroup::"cui-data"
)
when {
  principal.CUITrainingCurrent == true &&
  principal.CUITrainingExpiry > context.now
};

Training modules

Each module maps to one or more compliance frameworks. Completion writes the corresponding IAM tags.

IAM tag contract

qualify writes these tags. attest reads them. Neither side needs to know how the other works — the tag namespace is the full interface.

# Training completion (bool string)
attest:cui-training              = "true" | "false"
attest:hipaa-training            = "true" | "false"
attest:awareness-training        = "true" | "false"
attest:ferpa-training            = "true" | "false"
attest:itar-training             = "true" | "false"
attest:data-class-training       = "true" | "false"
attest:research-security-training = "true" | "false"

# Expiry timestamps (RFC3339)
attest:cui-training-expiry       = "2027-04-29T00:00:00Z"
attest:hipaa-training-expiry     = "2027-04-29T00:00:00Z"
attest:awareness-training-expiry = "2027-04-29T00:00:00Z"

# Identity
attest:lab-id                    = "<lab-identifier>"
attest:admin-level               = "none" | "env" | "sre"

Full contract spec: attest/docs/integrations/qualify.md

CLI training

The qualify CLI delivers training modules directly in the terminal — no browser required. Users complete modules, pass quizzes, and receive IAM tag writes from the command line. A polished web-based interface is available as an institutional subscription.

qualify train status

Training status for alice@mru.edu
  cui-fundamentals        ✗ required  (CUI data access requires this)
  hipaa-privacy-security  ✗ required
  nih-research-security   ✗ required  (NIH funding)
  security-awareness      ✗ required  (annual)

qualify train start cui-fundamentals

──────────────────────────────────────────────────────────────────────
  Controlled Unclassified Information (CUI)  —  Section 1 of 3: What is CUI?
──────────────────────────────────────────────────────────────────────

CUI is information the Government creates or possesses that requires
safeguarding consistent with applicable laws and regulations...

  [Press Enter to continue — 'q' to save and quit]

──────────────────────────────────────────────────────────────────────
  Quiz: 5 questions, 80% to pass
──────────────────────────────────────────────────────────────────────

  Q3: A contract deliverable with a DoD clause contains export-
  controlled technical data. How should it be handled?

    1) Share via email as a PDF attachment
    2) Store in CUI-designated S3 environment with access logging
    3) Post to a public GitHub repository (technical reports are OK)
    4) Save to personal OneDrive for convenience

  Answer [1-4]: 2

  ✓ Correct. CUI must be stored in an authorized enclave.

  Score: 4/5 (80%) — PASSED ✓

  IAM tags written:
    attest:cui-training        = true
    attest:cui-training-expiry = <1 year from now>

  Cedar PDP will grant CUI data access on the next request.
  Next up: qualify train start security-awareness

qualify train status
  cui-fundamentals        ✓ current   expires 2027-05-01
  hipaa-privacy-security  ✗ required

Core commands

qualify onboard --email <email> --lab-id <id>  # full guided onboarding (role + training + lab)
qualify onboard --email <email> --dry-run      # preview what would be configured
qualify train required                         # modules required for active attest frameworks
qualify train required --framework hipaa nih-gds # check specific frameworks offline
qualify train list                             # all available modules
qualify train start <module-id>               # begin or resume a module
qualify train status                           # current training completion state
qualify train status --user <email>           # admin: check any user
qualify lab setup --user <email> --lab-id <id>   # assign user to lab
qualify lab register-role --user <email> --role-arn <arn>

Institutional LDAP integration

qualify can read attributes directly from your institution's LDAP / Active Directory, automating lab membership assignment and — critically — US person determination for ITAR export control compliance.

What LDAP provides

attest's principal resolver has a built-in LDAP source that queries your directory at Cedar evaluation time. It reads group membership (memberOf) to automatically populate lab assignments and admin levels — no manual qualify lab setup needed for institutions with well-structured directories. It can also read custom attributes for citizenship and residency status.

# Configure the LDAP source in .attest/sre.yaml
principal_sources:
  - type: ldap
    url: "ldap://directory.university.edu:389"
    base_dn: "dc=university,dc=edu"
    bind_dn: "cn=attest-svc,ou=serviceaccounts,dc=university,dc=edu"
    bind_pass_env: LDAP_BIND_PASS   # read from environment variable

# Groups mapped automatically:
#   lab-*       → principal.LabMembership
#   research-*  → principal.LabMembership
#   admin-*     → principal.AdminLevel = "env"

ITAR: US person determination

ITAR (International Traffic in Arms Regulations) prohibits sharing controlled technical data with non-US persons — including on US soil (deemed exports). A US person is a US citizen, lawful permanent resident (LPR / green card), or protected individual. The determination is based on immigration status, not nationality or employer.

Many institutions store this in their HR/identity directory. The LDAP source can read these attributes and write the attest:country IAM tag that attest's Cedar policy evaluates before granting access to ITAR-scoped resources.

# Attributes vary by institution — common patterns:

# Option A: custom boolean attributes
usCitizen: TRUE
permanentResident: TRUE

# Option B: employment authorization field
employmentEligibility: "USCitizen"
employmentEligibility: "LPR"
employmentEligibility: "OPT"          # Optional Practical Training — non-US person
employmentEligibility: "H1B"          # H-1B visa — non-US person
employmentEligibility: "J1"           # J-1 Exchange Visitor — non-US person

# Option C: country of citizenship
citizenshipCountry: "US"
citizenshipCountry: "CN"              # → denied ITAR + NIH countries-of-concern

# The LDAP source maps these to attest:country IAM tag
# US citizen or LPR → attest:country = "US"
# Otherwise         → attest:country = <ISO 3166-1 alpha-2>

How Cedar enforces it

Once attest:country is set on the user's IAM role (either via LDAP or manually with qualify lab setup), attest's Cedar PDP evaluates it against the ITAR and NIH GDS frameworks at every API call:

# Cedar policy compiled from itar framework:
forbid (principal, action, resource)
when {
  resource.itar_controlled == true &&
  !(principal.institutional_affiliation_country == "US")
};

# Cedar policy compiled from nih-gds framework (NOT-OD-25-083):
forbid (principal, action, resource)
when {
  resource.nih_controlled_access == true &&
  principal.institutional_affiliation_country in
    ["CN", "RU", "IR", "KP", "CU", "VE"]
};

See also: attest ITAR framework · qualify↔attest integration contract

Lab setup commands

Identity attributes (attest:lab-id and attest:admin-level) are set during lab onboarding, not on training completion.

# Register a user's IAM role ARN first
qualify lab register-role \
  --user alice@mru.edu \
  --role-arn arn:aws:iam::123456789012:role/user-alice

# Assign to a lab and set admin level
qualify lab setup \
  --user alice@mru.edu \
  --lab-id chen-quantum-lab \
  --admin-level none   # none | env | sre

# Result: two IAM role tags written immediately
# attest:lab-id=chen-quantum-lab
# attest:admin-level=none

Admin levels: none (user, no admin access), env (environment admin), sre (SRE admin — phishing-resistant MFA required)