RiskMandate v1.34.4
The business case · Secrets and dynamic credentials

OpenBao, by the risk it changes

A secrets manager that issues dynamic credentials with leases. Revoking a lease invalidates the secret at once, and a prefix revokes every lease under it in one command. Written as answers, an agent whose credentials all come from OpenBao can be stopped in one action, in minutes.

Open source: MPL-2.0 · OpenSSF (Linux Foundation) · get involved

The deployment: The model's typical deployment, with the answers this project addresses stated as they are without it: stopping it takes more than one action; nobody knows how long stopping it would take.

The model: the RiskGraph Explorer's 49 facts, 49 risks and 10 roles, copied into this site with its provenance; the register below is computed, not written. How.

01 · What it does

In its own words, and nothing more.

  • Leases on every dynamic secret, revocable one at a time or by prefix. “When a lease is revoked, it invalidates that secret immediately and prevents any further renewals.” · openbao.org, read 24 September 2026
02 · The answers it changes

Same deployment, different answers.

The model asks sixteen questions about an agent deployment. A product’s effect is written as the answers it changes, and each change says what kind of change it is: a statement of what is true, an expectation the agent is asked to meet, a setting, or a boundary enforced by something the agent’s grant does not include.

The questionWithout itWith itHow, and who holds it
If you had to stop it right now — could you?Yes, eventuallyYes, one actiona boundary, held by the deployer. Only if every credential the agent holds is an OpenBao dynamic secret. Revocation stops later use; it does not undo what is already in flight. “When a lease is revoked, it invalidates that secret immediately and prevents any further renewals.” · openbao.org, read 24 September 2026
How long would stopping actually take?Don't knowMinutesa boundary, held by the deployer. Minutes: one command, if somebody knows which prefix belongs to the agent. “When a lease is revoked, it invalidates that secret immediately and prevents any further renewals.” · openbao.org, read 24 September 2026
03 · The register, before and after

3 retired, 20 unchanged.

Computed from the model for the deployment above: every risk that holds without it, and every risk that holds with it.

3retired
0new
23 → 20entries on the register

Retired

RISK-9
Stopping the agent takes more than one actionoperational · SRE / platform on-call
RISK-19
The time a stop takes is unknown to the people who would perform itoperational · SRE / platform on-call, Platform owner
RISK-29
The stop capability cannot be compared to any exposure windowoperational · CISO
04 · From the operator to the board

Who carries less, and who carries the same.

Each risk is assigned to the roles it belongs to, and each role reports to another until the board. The count beside each role is the entries it holds without the product and with it.

Operators

who run it, and are paged when it goes wrong
SRE / platform on-call9 → 7 −2retired RISK-9, RISK-19
Customer-facing service owner2 → 2

Owners

who own what it may touch, and can say what happened
Platform owner3 → 2 −1retired RISK-19
CISO8 → 7 −1retired RISK-29
DPO6 → 6

Executives

who answer for speed, product, cost and the whole
CTO3 → 3
Chief Product Officer4 → 4
CFO0 → 0
CEO3 → 3

The board

who must be able to defend how it is run
Board4 → 4

At the board: the corporate register

Corporate risks have no facts of their own. They hold while any risk that leads into them holds, so a single product rarely retires one. What it changes is how many reasons the board is being given.

CORP-1
Regulatory exposure — the organisation may be operating outside obligations it is subject tostill holds · risks leading into it: 2 before, 2 after
CORP-2
Customer harm — customers may be affected by decisions or changes nobody madestill holds · risks leading into it: 2 before, 2 after
CORP-3
Operational resilience — the organisation may be unable to restore a service it depends onstill holds · risks leading into it: 1 before, 1 after
CORP-6
Loss of control — the organisation operates a system it may not be able to stop or explainstill holds · risks leading into it: 2 before, 2 after
06 · What it adds

Every product is also a new thing in the estate.

It holds every secret it issues, which makes it the most sensitive system in the estate. Its audit documentation says it fails closed: OpenBao will not respond to requests when no enabled audit devices can record them.

Free, but not free

What adopting it takes, before any of this is true.

An open-source project costs nothing to download and something to adopt. Every change above depends on the work below, and most of it is customisation to your own deployment.

  • Move the agent's credentials to dynamic secrets, which means every system it calls has to support them.
  • Give each agent its own prefix, so one command stops one agent and nothing else.
  • Write down who may run the revocation, and practise it.
Where its pages disagree

Published unresolved, for OpenSSF (Linux Foundation) to settle.

Each pair was read on the same day. We have not tested which is true, because that would mean testing somebody else’s system.

  • revocation. The lease page says revocation invalidates a secret immediately; the revoke command documents a force option that deletes the lease even if the secret engine's revocation fails. lease · revoke
What this does not claim

The limits of the case, stated by the case.

  • That stopping has been exercised. Whether it was ever done in production is a different question, and it stays unanswered.
  • That it was tested. Nothing was installed or run; every change rests on the documentation quoted beside it.
  • That the register is complete. It is one model, for one stated deployment. A different deployment changes the answers, and so the case.

Next. Published, and sent to the project's maintainers at the same time. If a change is wrong, or another answer should move, the case changes with the date they said so.

The same method, for your product

Make the case in the register’s own terms.

If you build a security product for agents, the case for it can be written the same way: what it does in your own words, the answers it changes, and the register before and after. If a case here is wrong about you, tell us and it changes with a date.

All the casesWrite to us