Which token reaches which environment

Abstract

Pipelines exchange short-lived tokens bound to a repository, a branch and an environment. Production trusts only its protected branch and its own stack; development's tokens are refused there; the build plane may plan but only the deploy stack, after approval, may apply; and laptops hold nothing.

Environments do not share trust, and no person holds a deploy credential.

Its figure in the paper: § IV →

The inputs

Who presents the token

The environment it asks to enter

What it asks to do

The outcome

accepted

Short-lived, bound to this repository, this branch and this environment, and nothing else.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 4 attempted · 0 refused

Ship from a feature branch
A job on an unprotected branch asks to apply to production.
Reuse development's token
The development stack's token is presented to production.
Deploy from a laptop
An engineer applies directly from their machine.
Let the build plane apply
The build job applies the change itself.

Setting up the instrument…

Declared limits

Identity providers and pipeline products are named by role only.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § IV

The error budget →

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →