cqrenet/policies
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add browsable INDEX.md, update README, and refine AI agent identity controls

Browse Source
This commit is contained in:
tomas.kracmar
2026-07-07 17:12:17 +02:00
parent 8d26180b8e
commit 2fec5e8fc4
5 changed files with 84 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Security/secrets_management_policy.md
+2 -1
View File
@@ -38,7 +38,8 @@ This policy is the **canonical source** for cryptographic algorithm/parameter st
### 2.4 Access Control
- Access to secrets **must** follow least privilege and, where supported, just-in-time elevation.
- All secret retrieval **must** be logged (who, what, when).
- Human access to production secrets **should** be exceptional and time-bound; services **must** authenticate via managed identity/certificate rather than a retrieved static secret where the platform supports it.
- Human access to production secrets **should** be exceptional and time-bound; services **must** authenticate via managed identity/certificate rather than a retrieved static secret where the platform supports it.
- **AI Agent (Autonomous) accounts** (per [Authentication Policy §3.1](authentication_policy.md)) **must not** hold a static long-lived credential equivalent to a service account password. Agent credentials **must** be short-lived and scoped to the task/session, expiring automatically at task completion — a compromised agent session should not yield a standing key an attacker can reuse after the session ends.
### 2.5 Kill-Chain Secrets (Barbell Principle)
Secrets gating existential systems — PKI/CA root passphrases, backup/DR encryption master keys, break-glass vault master credentials, HSM activation secrets — **must** receive protection disproportionate to ordinary secrets: