{
  "product": "Specification (reference)",
  "title": "Secrets Manager",
  "summary": "Store, distribute and rotate credentials without them landing in a file.",
  "category": "infra",
  "entries": [
    {
      "path": [
        "AI",
        "Storage",
        "Encrypted at rest with a separate key"
      ],
      "value": "",
      "status": "yes",
      "note": "envelope encryption"
    },
    {
      "path": [
        "AI",
        "Storage",
        "Versioned secrets with rollback"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Storage",
        "Structured and binary secrets"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Access",
        "Policy per identity and per path"
      ],
      "value": "",
      "status": "yes",
      "note": "least privilege by default"
    },
    {
      "path": [
        "AI",
        "Access",
        "Short-lived credentials rather than static ones"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Access",
        "Machine identity via workload attestation"
      ],
      "value": "",
      "status": "yes",
      "note": "not a bootstrap secret in a file"
    },
    {
      "path": [
        "AI",
        "Rotation",
        "Scheduled rotation without downtime"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Rotation",
        "Dynamic credentials created per request and revoked on lease end"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Rotation",
        "Emergency revocation of a leaked secret"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Distribution",
        "Injection into processes without writing to disk"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Distribution",
        "Client caching with a bounded TTL"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Audit",
        "Every read and write logged with identity and time"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Audit",
        "Tamper-evident audit log"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Safety",
        "Secrets never appear in logs or error messages"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Safety",
        "Sealed or locked state after restart until unsealed"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Recovery",
        "Documented break-glass procedure and key shards"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    }
  ]
}