Skip to content

Access and Secrets Register — Completion checklist

Template: TPL-05-03 ../02-Templates/Access-and-Secrets-Register-Template.md | Version: 0.3
How to use: tick an item only after inspecting the completed record and its evidence. Every unticked item needs an OPEN- entry with an owner, or a written, approved disposition.

Content checks

  • [ ] 01. Human service and machine identities — Every IAM role and service account found in infra code is listed.
  • [ ] 02. Least privilege role and justification — No wildcard (*) actions on sensitive resources without written justification.
  • [ ] 03. Credential storage rotation and expiry — Every secret has a rotation period; none is stored in code or CI variables in plaintext.
  • [ ] 04. Access approvals and revocation — Each grant cites an approval ticket.
  • [ ] 05. Emergency access logging and review — Every break-glass use is reviewed within 2 working days.
  • [ ] 06. Third-party accounts and audit evidence — Each vendor account has an owner and expiry.

Record control checks

  • [x] Document ID follows KAI-<PRODUCT>-ACC-NNN and is unique in the product.
  • [x] Product, version and commit SHA match the related records.
  • [x] No placeholder rows remain; every gap names an owner and an OPEN- item.
  • [x] Every cited link, file path and ID resolves.
  • [ ] Security, privacy, AI/ML and medical-software applicability checked and routed to qualified reviewers where relevant.
  • [x] No patient identifiers, secrets or production data copied into the record.
  • [x] Nothing was taken from the worked examples as if it were evidence.
  • [ ] Named independent reviewer completed review; approval recorded with date.

Reviewer: Technical reviewer (name to be assigned — OPEN-001) | Date: Pending | Outcome: [Complete / Returned with actions]

Self-check by Claude Code, 2026-10-28, at a6b4429. Ticked items were verified mechanically in this session: sdlc.py validate 0 errors (75 records, stages 01–10); sdlc.py trace no duplicate IDs and every REQ linked to design and test; code citations resolve at a6b4429 (except files in the separate Visionary_oral_ML repository, labelled as external). Content checks are left for the named reviewer; every gap is an owned OPEN- item in the record. Reviewer and approval items are for people.