Harden Agent Enrollment Flow #8

New Issue

2026-02-16T14:32:37Z

boris commented

2026-02-16 14:32:37 +00:00

As a platform administrator I want enrollment tokens and enroll requests to be tightly controlled in order for me to reduce unauthorized server enrollment risk.

Acceptance Criteria:

Within 7 calendar days, enrollment tokens enforce max TTL of 24 hours and single-use behavior.
Within 7 calendar days, enroll endpoint is rate-limited to 5 requests per minute per source IP.
Failed enrollment attempts generate telemetry/audit events with reason codes.
Security test cases cover expired, reused, malformed, and brute-force token attempts.

As a platform administrator I want enrollment tokens and enroll requests to be tightly controlled in order for me to reduce unauthorized server enrollment risk. Acceptance Criteria: Within 7 calendar days, enrollment tokens enforce max TTL of 24 hours and single-use behavior. Within 7 calendar days, enroll endpoint is rate-limited to 5 requests per minute per source IP. Failed enrollment attempts generate telemetry/audit events with reason codes. Security test cases cover expired, reused, malformed, and brute-force token attempts.

boris added this to the Minumum Marketable Product milestone 2026-02-16 14:32:37 +00:00

boris added the Kind/Security label 2026-02-16 14:32:37 +00:00

boris self-assigned this 2026-02-16 14:32:37 +00:00

boris added this to the Keywarden project 2026-02-16 14:32:37 +00:00

boris added the

Priority

Critical

1

label 2026-02-16 14:33:02 +00:00

boris moved this to In Progress in Keywarden on 2026-03-28 21:48:38 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: boris/keywarden#8