Constrain access and rehearse rollback

Separate runtime and operator roles for answer API + indexer sharing provider key via versioned secrets manager. Runtime may only perform the narrow actions that security engineer rotating openai/prod after contractor offboarding needs; operators get audited break-glass with TTL. Encode a negative probe that denies the privilege trick related to revoke v1 while indexer still cached v1 → 401 storm.

Redact prompts/PII at collection. Secrets enter via a manager or workload identity — never source, fixtures, or exception strings. Incident SEC-REVOKE-EARLY-21 should be impossible if these controls hold. Output allowlists and schema checks stay in force on error paths.

Rehearse the rollback or kill switch timed against a clock. Record actor, reason, prior revision/secret/flag, and verification query. Invariant reminder: dual-key window: readers accept v1+v2; revoke v1 only after emit proves zero v1 use for 30m.

Abuse cases unique to this lab include the privilege path implied by revoke v1 while indexer still cached v1 → 401 storm. Prove a read-only role cannot mutate. Break-glass tokens expire; leftover tokens fail the drill. Dependency pin/digest story matters when images or models move under you. Document how to rotate the credential that answer API + indexer sharing provider key via versioned secrets manager uses without a full outage window longer than your dual-run plan. Security evidence is part of ship, not an appendix nobody reads.

List network egress destinations and justify each. Ensure debug endpoints are off by default in the shipping config. Verify that error responses do not echo secrets or raw stack frames to clients. For multi-tenant paths, add a cross-tenant probe fixture. Time the rollback drill twice — once with the author, once with a peer. Store the drill transcript beside the threat notes for the incident id. In this chapter the product is answer API + indexer sharing provider key via versioned secrets manager, the human stakeholder is security engineer rotating openai/prod after contractor offboarding, and the incident id you design against is SEC-REVOKE-EARLY-21. Re-state the oracle in your notes — rotate to v2 → deploy → traffic on v2 → revoke v1 with audit event ROT-2026-07-30 — and keep the invariant visible: dual-key window: readers accept v1+v2; revoke v1 only after emit proves zero v1 use for 30m. Track secret_version_share and auth_fail_rate as the scoreboard. Surface under change control: secrets manager path openai/prod. If you only have forty minutes, finish the fixture for revoke v1 while indexer still cached v1 → 401 storm before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.