Prompt & Configuration Registry · View 21 of 21 · Assurance
Decisions
- Authoring permission never implies promotion permission in a protected environment. The refusal is drawn in the sequence rather than described, because it is the control most likely to be quietly relaxed.
- The signing key is never held by the service that authors content and never by the fleet that consumes it. Signing is a call, not a capability.
- Verification is against a published, versioned trust bundle. A resolver that does not recognise the signing key rejects the artefact and keeps the previous one — never accepts and never fails the request.
Assumptions
- SPIRE issues short-lived SVIDs to application workloads and the artefact registry authenticates on them, so no long-lived credential exists for pulling bundles.
- The signing key rotates on a fixed schedule with the old key trusted throughout an overlap window long enough for every resolver to pick up the new trust bundle.
Risks
- Trust-bundle distribution must lead key rotation. If a new key signs before the fleet trusts it, the fail-closed posture turns into a fleet-wide refusal — the one way this design can cause an outage.
- An operator with OpenBao administrative rights can grant themselves the sign role. Separation here is a policy control backed by audit, not a cryptographic one, and the ledger is the compensating evidence.
