GovernanceOpt-in

Secrets that expire on a schedule, not in an incident

Attach a policy to any vault secret: rotate every N days, warn before due, verify the new value against its provider before it goes live. AWS IAM keys and GCP service-account keys rotate automatically; LLM and GitHub tokens get a guided swap. Every version is kept, the previous one stays valid through a grace window, and a GitHub Action mirrors the new value into repository secrets.

Opt in: requires the vault.rotation flag

• Versioned secrets with a grace window and immediate revoke
• Automatic executors for AWS IAM and GCP service accounts
• Provider verification before the swap: LLM, GitHub, AWS, GCP
• Due and overdue notifications through Slack and signed webhooks (Opt in, Slack app beta and alerts.rules flag)

1. SecurityJWT auth, bcrypt hashing, webhook signature verification, and service-token guards.
2. AuditAppend-only audit events for auth, vault, integrations, triggers, and workspaces.
3. BudgetMonthly token budgets with hard-stop and warning thresholds, enforced pre-execution.
4. Approval gatesPause any workflow at an approval node until someone signs off, or the request expires.
5. SandboxRun tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.