Deny by default
No identity holds standing access to Vault material. Every read requires an authorisation decision evaluated at the moment of request, and that decision expires.
Protects canonical artefacts, critical evidence, and institutional authority.
Protejează artefactele canonice, dovezile critice și autoritatea instituțională.cidavault.com holds the material within the Central Intelligence Data Architecture that must never be casually reachable: credentials, executed contracts, intellectual property filings, signing keys and regulated correspondence. Nothing here is accessible because someone is logged in. Access requires an authorised decision, a stated purpose and a permanent record.
Most breaches are not cryptographic failures; they are governance failures. Credentials outlive the person who created them, contracts are copied into shared drives, and privilege accumulates silently. The Vault is built to make each of those outcomes structurally impossible rather than merely discouraged.
No identity holds standing access to Vault material. Every read requires an authorisation decision evaluated at the moment of request, and that decision expires.
Sensitive operations require elevation with a named approver and an explicit window. When the window closes, access ends without action or reminder.
Key custody, policy authorship and operational access are held by distinct roles. No single actor can both change the rules and exercise them.
Credentials and keys carry scheduled rotation from creation. A secret that cannot be rotated automatically is not accepted into custody.
Executed agreements, IP filings and priority documents are held with integrity proofs, so authenticity can be demonstrated years later without relying on institutional memory.
Secrets are injected into authorised workloads at runtime rather than handed to humans. The default path exposes a reference, never the value.
Encryption is applied at multiple independent layers with separate key hierarchies, so compromise of any single layer or key does not yield plaintext. Envelope encryption binds each object to a data key that is itself sealed by a hardware-held master key.
path "vault/contracts/*" { capabilities = ["read"] require = ["elevation", "named-approver"] max_ttl = "15m" purpose = ["legal-review", "audit"] jurisdiction = ["EU", "UK"] egress = "reference-only" # never plaintext } path "vault/credentials/*" { capabilities = ["inject"] consumers = ["workload:ronor-runtime"] human_read = false rotate_every = "720h" } audit { mode = "append-only" record = ["identity", "purpose", "decision", "approver", "jurisdiction"] denials = true # denials are evidence }
The Vault does not recognise anonymous or automated privilege escalation. A request presents an identity, a purpose and a jurisdiction; the Control Plane evaluates policy; and if elevation is required, a human approver is recorded alongside the decision.
Denials are retained with the same permanence as approvals. A pattern of refused requests is a security signal, and discarding it would remove the evidence that matters most.
The audit log is the Vault's most important artefact. It is append-only, tamper-evident and retained independently of the material it describes, so that the history of access survives even the removal of the underlying object.
| Chamber | Content | Access path | Elevation |
|---|---|---|---|
| Credentials | API keys, service secrets, tokens | Runtime injection only | Human read prohibited |
| Contracts | Executed agreements and amendments | Reference with scoped view | Named approver, 15 minutes |
| Intellectual property | Filings, priority documents, disclosures | Read with integrity proof | Named approver, 30 minutes |
| Signing keys | Code, document and transaction signing | Operation only, never export | Dual control required |
| Regulated records | Correspondence under obligation | Compliance role, purpose-bound | Legal-hold aware |
Records are chained so that any modification or excision of history is detectable, and detection is automated rather than dependent on review.
Audit history is stored apart from Vault material with its own retention policy, surviving object deletion and account changes alike.
Auditors can reconstruct who accessed what, under which purpose and on whose approval, without requesting an export from the team under review.
The Vault is the assurance component of CIDA. It secures what the Data Lake must not expose, protects the credentials the Control Plane uses to orchestrate, safeguards the agreements the Archive references, and ensures the Cortex can cite sensitive material without disclosing it.
Vault provisioning begins with a custody review: what material is held, who may open it, under which purposes and jurisdictions, with which approvers, and what the audit obligation is. Access follows the review, never precedes it.
[email protected] · No cookies · No tracking