PROD-WF-005 — Hide Run as User until execution identity is enforced

Field	Value
Status	Open; source-verified
Architecture state	Exposed incomplete feature
Severity	High
Affected surface	Workflow create, edit, clone, and detail
Components	sparqd/oqullus, sparqd/workflow-backend, Airflow, Spark runtime, storage and Trino access paths
Associated issue	sparqd/oqullus#548

Where the problem appears

Open workflow create or edit and inspect Run as User. Oqullus displays and submits a user identifier as though it determines the execution principal.

Concrete observed case

Workflow-backend requires, stores, clones, and returns run_as_user_id, but the reviewed DAG compiler, Airflow execution, Spark identity, storage credentials, and Trino identity paths do not consume it as an authoritative principal. The visible value can therefore disagree with the identity that actually accesses data and runs compute.

Expected condition

Hide the field while workflows use the existing platform runtime identity. Do not imply impersonation or user selection until an authorized server-side identity contract is propagated to and audited by every runtime boundary.

Cause and evidence

• Oqullus includes run_as_user_id in its workflow payload and validates that the form value is present.
• Workflow-backend persists the field as workflow metadata.
• No reviewed compiler or runtime path applies the value to Airflow, Spark, storage, or Trino execution.

Why it matters

Users and reviewers can mistake descriptive metadata for an access-control guarantee, making authorization and audit records misleading.

Existing controls and workarounds

Treat the displayed value as non-authoritative. Hide it and retain a backward-compatible backend default until the API and stored definitions can be migrated safely.

Alternatives considered

1. Recommended now: remove the control and use one documented platform runtime identity.
2. Implement selectable identity: expose only authorized service identities, derive the effective principal server-side, and propagate it end to end.
3. Keep the field as informational metadata — rejected because its current label communicates execution behavior.

Component involvement

• sparqd/oqullus removes the control from create, edit, clone, and detail.
• sparqd/workflow-backend supplies a safe compatibility default and later authorizes any explicit identity selection.
• Airflow, Spark, storage, and Trino integrations must consume and audit the same effective identity before the feature is re-exposed.

Reproduction and verification

Follow WF-S016.

Resolution conditions

Close when the incomplete field is absent from all product surfaces, or when the displayed, stored, executed, and audited principals are proven identical and unauthorized identity selection fails before publication or execution.

Validation and blockers

Product, frontend, workflow-backend, security, Airflow, Spark, storage, Trino, and operations reviewers must validate. End-to-end runtime identity evidence remains unavailable.