KrinosAI — Access and Secrets Register
Template ID: TPL-05-03 | Stage: 05-Development-Setup | Version: 0.3
Record: KAI-VORAL-ACC-001 — retrospective draft for Visionary Oral. Not approved.
Purpose: List every human, service and machine identity, what it can access and why, and how its credentials are stored and rotated.
Required inputs: HLD; environments; IAM policies; vault inventory.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-ACC-001 |
| Template used |
TPL-05-03 Access and Secrets Register v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-27 / 2026-10-27 / Pending |
| Applicable SOP and revision |
SOP-LC-05 v0.3 |
| Related issue, commit, requirement and evidence links |
docs/lifecycle/_evidence/scan-a6b4429.md §Environment variables (names only) |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. Observed from the repository, Git and build configuration at a6b4429; GitHub settings (branch protection, access lists) are not visible in the repository and are Not recorded unless stated. Only names of secrets are recorded, never values.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Human service and machine identities
| Identity ID |
Identity |
Type |
Owner |
| ID-01 |
GitHub users with repo access |
Human |
Tech Lead |
| ID-02 |
Clerk admin accounts (profiles.role = admin) |
Human |
Product Owner |
| ID-03 |
Web/API runtime (host env vars) |
Service |
Tech Lead |
| ID-04 |
PDF Lambda execution role |
Service |
Tech Lead |
| ID-05 |
Expo account krinos_ai (it@indiagbi.com) |
Human/service |
Mobile Lead |
| ID-06 |
GitHub Actions (keep-awake job) |
Machine |
ML Lead |
2. Least privilege role and justification
| Identity ID |
Permissions |
Justification |
| ID-01 |
Write to all branches |
Development — not least privilege (OPEN-038) |
| ID-02 |
All admin routes |
Doctor administration |
| ID-03 |
All secrets below |
Runtime |
| ID-04 |
S3 put/get |
PDF storage |
| ID-05 |
Builds, signing keys |
Mobile releases |
| ID-06 |
Calls the ML Space |
Keep-awake |
3. Credential storage rotation and expiry
| Secret |
Store |
Rotation |
Last rotated |
| MONGODB_URI |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| CLERK_SECRET_KEY |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| CLERK_WEBHOOK_SECRET |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| R2_ACCOUNT_ID / R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| AWS_REGION / S3_BUCKET_NAME / LAMBDA_PDF_URL |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| OPENROUTER_API_KEY |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| GROQ_API_KEY |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| HF_TOKEN / ML_BACKEND_URL / FIT_VALIDATOR_URL |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| RESEND_API_KEY / EMAIL_FROM |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| CASHFREE_APP_ID / CASHFREE_SECRET_KEY / CASHFREE_WEBHOOK_SECRET |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| CLOUDINARY_* (legacy) |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| JWT_SECRET |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| PDF_ACCESS_SECRET |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
| EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY (public) |
Host environment variables (Vercel/Render) — not recorded which |
None recorded — OPEN-041 |
Not recorded |
4. Access approvals and revocation
| Identity ID |
Approved by |
Ticket |
Revocation |
| ID-01 |
Not recorded |
None |
Not recorded — OPEN-041 |
| ID-02 |
Admin invite/role in profiles |
None |
Suspend in admin console |
5. Emergency access logging and review
| Account |
Logging |
Review |
| Database break-glass |
Not recorded |
Not recorded — OPEN-041 |
6. Third-party accounts and audit evidence
| Account |
Vendor |
Owner |
Expiry |
| Clerk |
Clerk |
Tech Lead |
Not recorded |
| MongoDB host |
Not recorded |
Tech Lead |
Not recorded |
| Cloudflare |
Cloudflare |
Tech Lead |
Not recorded |
| AWS |
AWS |
Tech Lead |
Not recorded |
| OpenRouter, Groq, Hugging Face |
Vendors |
ML Lead |
Not recorded |
| Resend, Cashfree |
Vendors |
Tech Lead |
Not recorded |
Expo krinos_ai |
Expo |
Mobile Lead |
Not recorded |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-007 |
Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Credentials rotated; files removed and purged from history; confirmation |
Open |
| OPEN-038 |
No branch protection, required reviews or CODEOWNERS recorded; changes are pushed directly to shared branches (app_dev, non-compliance) |
Tech Lead |
2026-11-15 (proposed) |
Yes |
Branch protection settings; PR template; CODEOWNERS |
Open |
| OPEN-041 |
No secrets vault, rotation schedule or access recertification; secrets live in host environment variables (and two were committed — OPEN-007) |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Vault or managed secrets with rotation dates |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-27 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Security & Privacy Officer (name to be assigned) |
Pending |
Pending |
Pending |