Altinn / Altinn/kihub

Define secure decommissioning process for production agents

Open
#121 0 comments 0 reactions 1 assignee Claimed by @MrCarrera View on GitHub
area/kitt priority/high type/task
Dominant language
TypeScript
Stars
5
Forks
0
Avg merge
1d 23h
Merged PRs (30d)
6

Description

## Description

No current item defines what happens when a production agent is retired.

## Source

Krav 10 "Sikker avvikling": access/keys revoked, sub-agents and scheduled tasks stopped, logs archived, registry status updated.

## Business Goal

Prevents "zombie" agents retaining live credentials or scheduled tasks after a team considers them retired — a direct security and accountability risk.

## Acceptance Criteria

- Documented decommissioning checklist covering: access/key revocation, sub-agent and scheduled-task termination, log archival, and registry status update to "decommissioned" with a date.
- Checklist is referenced from the agent registry (#75) as a required step, not optional guidance.

## Dependencies

Builds on #75 (registry status field).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.