# Credential Lifecycle Policy
#
# Operationalizes SPB-02..SPB-08 and SPB-12.
# Every credential in the ecosystem is governed by this policy.

version: 1

models:
  user_only_secret_store:
    description: "Storage for user-level credentials. Never readable by any agent."
    location: "<documented out-of-band path on the user's machine>"
    access:
      humans: [owner]
      agents: deny     # SPB-03 hard deny
    audit:
      reads_logged: false   # the store itself is not agent-readable
      humans_attest_quarterly: true

  agent_scoped_credential:
    description: "A credential issued for exactly one agent or task scope."  # SPB-02
    fields:
      label: "<integration-or-agent-name>"
      scope: "<minimum allowed actions/resources>"   # SPB-04
      max_ttl_seconds: 7776000                        # 90 days hard cap (SPB-05)
      rotation_interval_days: 90                      # SPB-08
      issued_at: "<ISO-8601>"
      revoked_at: "<ISO-8601 or null>"
    storage: "runtime-injected only; never written to repo, never logged"

  jit_token:
    description: "Just-in-time token for privileged operations." # SPB-06
    fields:
      label: "<purpose>"
      scope: "<minimum>"
      issued_at: "<ISO-8601>"
      expires_at: "<ISO-8601>"
      max_ttl_seconds: 3600                           # 1 hour default
      approver: "<security_owner_or_designate>"
      audit_trail: required                            # SPB-12

provisioning:
  request:
    fields_required: [requester, purpose, scope, runtime, expected_lifespan]
  approval:
    approver: security_owner
    review_checklist:
      - least_privilege_verified         # SPB-04
      - runtime_compatible_with_data     # SPB-10
      - rotation_plan_attached           # SPB-08
      - audit_emission_verified          # SPB-12
  deployment:
    method: runtime_injection_via_env_var_or_secret_manager
    forbidden:
      - committing the credential to any repo
      - logging the credential value
      - placing it in a chat or prompt
      - storing in a path readable by other agents

rotation:
  default_cadence_days: 90
  triggered_rotation_events:
    - suspected_compromise
    - role_change_of_owner
    - infrastructure_change
    - quarterly_attestation_finding
  procedure:
    - mint_new_credential
    - update_runtime_injection
    - verify_integration_on_new_credential
    - revoke_old_credential
    - log_audit_event_for_each_step

revocation:
  owner: security_owner
  required_for:
    - departure_of_owner
    - confirmed_compromise
    - failed_attestation
  procedure:
    - revoke_in_issuer
    - update_audit_log
    - notify_consumers
    - re-provision_if_legitimate_use_case_remains

emergency:
  owner: security_owner
  steps:
    - immediate_revocation
    - rotate_dependent_credentials
    - incident_response_playbook
    - post_mortem_within_5_business_days