---
id: monthly-secrets-elevation-review
name: Monthly Secrets-Elevation Review
enabled: true
owner: custodian-agent
governance: custodian
status: active
trigger:
  type: cron
  cron_expression: "0 8 1 * *"
  timezone: Europe/Berlin
  misfire_policy: skip
context_sources:
  - type: state-hub
    query: pending_decisions
    params:
      topic_id: f39fa2a3-c491-414c-a91b-b4c5fcc6139c
      status: open
    bind_to: context.decisions
---

# Monthly Secrets-Elevation Review

Runs 08:00 Berlin time on the 1st of every month. Checks whether any
temporary, broad credential/secrets-access elevations recorded as State Hub
decisions (topic: infotech / reuse-surface) are still open past their
review deadline, and opens a task to force a human yes/no on each one.

This definition exists because ad-hoc scheduling mechanisms (session-only
cron, cloud routines with no local access) cannot reliably re-check a local
security posture a month later — the check has to live somewhere durable.
`pending_decisions` (added alongside this definition) is a thin, generic
`GET /decisions/` passthrough, not special-cased to this one elevation, so
any future time-boxed decision under this topic gets the same monthly
check for free.

```rule
id: flag-overdue-elevation-decisions
for_each: context.decisions
bind_as: decision
condition: 'context.decision.status == "open"'
action:
  task_template: 'Review time-boxed decision: {context.decision.title}'
  description: 'Deadline {context.decision.deadline}. Rationale: {context.decision.rationale} Either resolve via resolve_decision() (elevation still needed -- extend deadline) or confirm removal (elevation no longer needed -- revert the settings.json entries added for it) and resolve as done.'
  target_repo: reuse-surface
  priority: medium
  labels: ["security", "access-review", "automated"]
```

`pending_decisions` returns every open decision under this topic, not just
the secrets-elevation one -- any decision-maker who records a pending
decision with a `deadline` under this topic gets swept into the same
monthly nudge, which is deliberate rather than a limitation to fix later.

The first target is the temporary `autoMode.allow`/`permissions.allow`
elevation added to `~/.claude/settings.json` on 2026-07-07 (State Hub
decision `11bf5cbf-458d-4275-a870-77a82b4058b9`, deadline 2026-07-31) for
ops-warden/kubectl/OpenBao secret reads, granted to consolidate the
reuse-surface hub write token and audit secrets-management locations.