Security

Use scoped identities, explicit permissions, and an auditable change process.

Start with least privilege#

Members receive permissions through workspace roles. Service identities receive only the scopes needed by the workload. Separate read-only automation, deployment automation, and workspace administration.

Role	Intended permissions
Viewer	Read resources, plans, and deployment history
Deployer	Plan and apply changes within assigned projects
Administrator	Manage workspace membership and policies

Review audit events#

du audit list --project catalog --since 24h
du identities describe catalog-runtime
du policies evaluate --identity catalog-runtime --action storage.read

Audit records include the actor, action, resource, timestamp, and result. Secret contents and bearer tokens are excluded from event payloads.

Rotate credentials#

Create a replacement credential, update the consuming workload, verify successful requests, and then revoke the old credential. Short-lived service tokens reduce the impact of accidental disclosure.