Documentation / Security & Access
Security audit trails, credential revocation and recovery
Record pre-mutation audit intents, revoke sessions, IdP groups or deployments, recover from MFA lockouts, and fence execution cells.
1. Audit trails and credential or deployment revocation
Privileged mutations record an audit entry before execution and redact tokens, passwords, and secret values. Operators can revoke local sessions, IdP group bindings, individual subject grants, or published deployments:
shell
# Revoke refresh token and clear OS keyring session:
rippflow logout --installation-url https://controller.example.com/rippflow-live
rippflow auth logout --json
# Revoke Enterprise IdP group binding (>=1.8.0):
rippflow rbac groups revoke --provider okta --group-id "grp-platform-ops" --json
# Revoke a scoped deployment and block new dispatches (>=1.9.0):
rippflow deployments revoke "$DEPLOYMENT_ID" --json2. Break-glass recovery and cell ownership fencing
Use customer-account AWS access for administrator lockout recovery and monotonic epoch fencing (>=1.2.0) to isolate unhealthy execution cells:
shell
rippflow cells list --json
rippflow cells drain cell-eu-west-1a --json
rippflow cells resume cell-eu-west-1a --json| Mechanism | Security & Recovery Behavior | Version / Status |
|---|---|---|
| Audit logging & secret redaction | Records actor, tenant, action and outcome for user creation, RBAC changes and owner mutations; secrets are redacted as [REDACTED]. | Implemented in Controller & core |
| Session & per-subject revocation | POST /auth/logout deletes the HMAC-keyed Valkey rippflow:ctrl:sess:* validity record and revokes the DynamoDB session binding immediately; CLI logout clears the OS credential store and revokes the OAuth token; disabling a subject in DynamoDB blocks access on the very next request. | Implemented (>=1.8.2; Valkey sessions >=1.10.0) |
| Bootstrap admin & MFA recovery escrow | Initial admin one-time password and single-use recovery sets are isolated in customer-account Secrets Manager under a dedicated security/recovery role. | Bootstrap secret implemented; MFA escrow verifier is a planned contract |
| Cell ownership epoch fencing | Failover increments the durable ownership epoch, rejecting stale worker completions and replayed callbacks while preserving issued callback verifiers. | Version-gated (>=1.2.0) |
Verified sources
Checked 2026-11-05.
- Audit intents and subject revocation f6c7970 · main
- Session logout and token revocation 3a3be99 · main
- Admin recovery escrow and factor reset 3a3be99 · main
- Cell ownership epoch fencing and drain 04cb082 · main