60 lines
2.4 KiB
Markdown
60 lines
2.4 KiB
Markdown
|
---
|
||
|
|
id: monthly-secrets-elevation-review
|
||
|
|
name: Monthly Secrets-Elevation Review
|
||
|
|
enabled: true
|
||
|
|
owner: custodian-agent
|
||
|
|
governance: custodian
|
||
|
|
status: active
|
||
|
|
trigger:
|
||
|
|
type: cron
|
||
|
|
cron_expression: "0 8 1 * *"
|
||
|
|
timezone: Europe/Berlin
|
||
|
|
misfire_policy: skip
|
||
|
|
context_sources:
|
||
|
|
- type: state-hub
|
||
|
|
query: pending_decisions
|
||
|
|
params:
|
||
|
|
topic_id: f39fa2a3-c491-414c-a91b-b4c5fcc6139c
|
||
|
|
status: open
|
||
|
|
bind_to: context.decisions
|
||
|
|
---
|
||
|
|
|
||
|
|
# Monthly Secrets-Elevation Review
|
||
|
|
|
||
|
|
Runs 08:00 Berlin time on the 1st of every month. Checks whether any
|
||
|
|
temporary, broad credential/secrets-access elevations recorded as State Hub
|
||
|
|
decisions (topic: infotech / reuse-surface) are still open past their
|
||
|
|
review deadline, and opens a task to force a human yes/no on each one.
|
||
|
|
|
||
|
|
This definition exists because ad-hoc scheduling mechanisms (session-only
|
||
|
|
cron, cloud routines with no local access) cannot reliably re-check a local
|
||
|
|
security posture a month later — the check has to live somewhere durable.
|
||
|
|
`pending_decisions` (added alongside this definition) is a thin, generic
|
||
|
|
`GET /decisions/` passthrough, not special-cased to this one elevation, so
|
||
|
|
any future time-boxed decision under this topic gets the same monthly
|
||
|
|
check for free.
|
||
|
|
|
||
|
|
```rule
|
||
|
|
id: flag-overdue-elevation-decisions
|
||
|
|
for_each: context.decisions
|
||
|
|
bind_as: decision
|
||
|
|
condition: 'context.decision.status == "open"'
|
||
|
|
action:
|
||
|
|
task_template: 'Review time-boxed decision: {context.decision.title}'
|
||
|
|
description: 'Deadline {context.decision.deadline}. Rationale: {context.decision.rationale} Either resolve via resolve_decision() (elevation still needed -- extend deadline) or confirm removal (elevation no longer needed -- revert the settings.json entries added for it) and resolve as done.'
|
||
|
|
target_repo: reuse-surface
|
||
|
|
priority: medium
|
||
|
|
labels: ["security", "access-review", "automated"]
|
||
|
|
```
|
||
|
|
|
||
|
|
`pending_decisions` returns every open decision under this topic, not just
|
||
|
|
the secrets-elevation one -- any decision-maker who records a pending
|
||
|
|
decision with a `deadline` under this topic gets swept into the same
|
||
|
|
monthly nudge, which is deliberate rather than a limitation to fix later.
|
||
|
|
|
||
|
|
The first target is the temporary `autoMode.allow`/`permissions.allow`
|
||
|
|
elevation added to `~/.claude/settings.json` on 2026-07-07 (State Hub
|
||
|
|
decision `11bf5cbf-458d-4275-a870-77a82b4058b9`, deadline 2026-07-31) for
|
||
|
|
ops-warden/kubectl/OpenBao secret reads, granted to consolidate the
|
||
|
|
reuse-surface hub write token and audit secrets-management locations.
|