Security
Know where trust begins. And where it ends.
Certificate automation handles powerful credentials. The first version provides explicit controls, with clear boundaries for your deployment and the work still ahead.
01 · Key custody
Follow the runner. Find the key.
Agent-managed
Private keys stay in agent state and configured deployment destinations. The control plane receives public certificates, inventory, status and events, not the agent’s private keys.
Hosted runner
Private keys reside on the control-plane host, sealed at rest with AES-256-GCM under the master key and bound to the organisation. They are included as encrypted state in backups.
Stored credentials
Connection secrets are encrypted with organisation-bound authenticated data. The master key is a file or environment value, optionally KMS-wrapped; release signing still uses a local key.
02 · People & access
Keep authority deliberate.
- Organisation-scoped resources, role-based access and API tokens bounded by their creator’s role and membership.
- HttpOnly browser sessions and CSRF protection for mutations.
- TOTP with replay protection and one-use recovery codes; passkeys require user verification.
- OIDC code flow with PKCE and verified tokens; enforcement retains an owner break-glass path.
03 · Change controls
Approve the exact change.
- Approval rules can require distinct people and exclude the person making the material change.
- Approval binds to the certificate fingerprint and is invalidated by material configuration changes.
- Maintenance windows and emergency overrides are enforced by policy-capable runners.
- Operators can deliver keys and execute configured hooks on assigned systems. Give this role only to trusted infrastructure operators.
04 · Agents & networks
Verify identity. Limit reach.
- Limited-use enrollment creates an agent identity. Key-bound signed requests scope configuration and reports to that identity and its assignments.
- Worker updates verify signed version, platform, digest and size; failed startup restores the previous worker and quarantines the failed artifact.
- Initial installation still depends on verifying the distributed binary. MSI/Authenticode and notarised macOS distribution are outstanding.
- Hosted mode blocks private and reserved destinations after DNS resolution, local connectors and ambient cloud identities. In-network agents remain trusted execution boundaries.
- Signed worker updates do not upgrade the stable service supervisor. Plan supervisor replacement as a separate maintenance operation.
Shared responsibility
Controls need an operator.
Provided by the product
- Encrypted connection secrets and hosted key state.
- Durable notifications, report deduplication and outage replay.
- Backup manifest verification, integrity checking and decryption checks on restore.
- A per-organisation audit hash chain that detects modified interior records.
Owned by the service operator
- HTTPS termination, trusted proxy configuration and restricted network access.
- Your infrastructure team supplies least-privilege credentials and agent service permissions.
- Encrypted off-host backups, separate key escrow and regular isolated restore drills.
- External log retention, monitoring and an accountable recovery process.
Explicit limits
Evidence, without a compliance badge.
This development build is not production-certified. An independent penetration test, multi-tenant scale and isolation review, external immutable audit anchoring, SCIM, SAML and HSM-backed release signing remain outstanding. A database administrator could truncate or rebuild the local audit chain; it is not an external immutable log.
OIDC enforcement does not revoke API tokens. With no SCIM, disabling an identity at the provider does not immediately terminate existing product sessions, which can last 12 hours; remove the member in clm.mt too. Keep owner break-glass credentials protected.
Review platform-specific validation →Make recovery part of setup.
Protect the master key, preserve update trust, and practice recovery before a certificate outage makes it urgent.