Secrets Distribution Service  ·  View 03 of 34  ·  2 · People and journeys

Actors and Their Journeys

Eight actors in three groups, each with the goal they would state themselves and the journeys the platform owes them.

Editable source SVG draw.io All views
Consumers of credentials Service team ≈ 300 teams Goal — Ship a service whose repository, image and pipeline hold no password at all. Core journeys Ship a service with no stored password Move a secret from custody to brokered Workload 40,000 instances Goal — Have a working credential before my first query and a fresh one before it lapses. Core journeys Attest and open a session Renew without a restart Legacy consumer cannot be modified Goal — Keep reading the file I already read, and not break when it changes. Core journeys Read a credential from tmpfs Owners and responders Secret owner 3,200 custodial secrets Goal — Rotate a partner key with no outage, and know who still holds the old one. Core journeys Rotate a key past a straggler Security responder on call Goal — Say who had it, then make it useless, within minutes. Core journeys Contain a leaked credential Read a secret under break-glass Auditor internal and external Goal — Show that every read had a named reader, and no one could erase it. Core journeys Answer who read a secret People who run it Platform SRE no standing read Goal — Keep issuance up through a restart storm without extending a single lease. Core journeys Absorb a node-pool replacement Restore a store without reviving a credential Key custodian security office Goal — Hold the root key so that the platform team cannot use it alone. Core journeys Rotate an envelope key Seal a partition on command Actors — Who It Serves and What Each of Them Gets to Do Person or role Journey / task Security / platform External / third party v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • The workload is an actor with its own goal. Most of the platform's traffic has no human behind it, and its needs (a credential before the first query, a new one before the old one lapses) set the latency and availability targets.
  • The platform SRE's goal is written as a constraint: keep issuance up without extending a lease. An operator who can extend lifetimes to buy availability holds a switch that silently voids every containment claim.
  • Key custodians are a separate actor from the platform team. Separation of duty is only real if it is visible on the cast list.

Journeys mapped

  • View 4: a service team ships with nothing stored. View 5: a responder contains a leaked database password. View 6: a secret owner rotates a partner key past a job that reads it once a month.

Not mapped, and why

  • The auditor's journey is one query (view 15). The key custodian's journeys are ceremonies with runbooks, not product experiences, and are covered on views 24 and 32.
◀  High-Level Architecture All views Journey — Ship With No Stored Password  ▶
Solution Architecture v1.0 · Security Platform Architecture · 2026-09 · 34 views · open source, fully on-premises03-actors-and-journeys