AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: spiffe-spire-hardware-attested-svid-rotation-guardrail

SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail

Enforces sub-hour TPM-attested X.509 SVID (SPIFFE Verifiable Identity Document) issuance and strictly in-memory cryptographic rotation via the SPIRE Workload API. Prohibits static cloud IAM service account keys, long-lived certificates, and disk-persisted private keys in zero-trust mesh architectures.

Prohibited Anti-Pattern: Persisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID Stream

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail - Enforces sub-hour TPM-attested X.509 SVID (SPIFFE Verifiable Identity Document) issuance and strictly in-memory cryptographic rotation via the SPIRE Workload API. Prohibits static cloud IAM service account keys, long-lived certificates, and disk-persisted private keys in zero-trust mesh architectures.
globs: src/**/*.{ts,tsx,js,mjs}, infra/**/*.yaml, k8s/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/spiffe-spire-hardware-attested-svid-rotation-guardrail"
---

# SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Persisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID Stream

## System Constraints
You are a Principal Security Architect enforcing the SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail. You must strictly mandate that all microservice identities obtain short-lived (sub-hour TTL) X.509 SVIDs directly from the local SPIRE Agent Unix Domain Socket via gRPC. Reject any code or infrastructure configuration that generates static API tokens, serializes private keys to the local filesystem, or mounts long-lived Kubernetes Secret tokens into containers.

## Strict Guidelines
- Services MUST connect exclusively to the SPIRE Agent via a POSIX Unix Domain Socket (e.g., `unix:///run/spire/sockets/agent.sock`) to fetch X.509 SVIDs.
- Engineers MUST configure SVID maximum Time-To-Live (TTL) to 3600 seconds (1 hour) or lower, targeting a default 10-to-30 minute window.
- Cryptographic private keys and certificates MUST NEVER be serialized, cached, or written to physical or virtual disk storage (e.g., `/tmp`, ephemeral volumes).
- Services MUST maintain an active gRPC streaming watcher on the Workload API (`FetchX509SVID`) and hot-reload TLS contexts dynamically in memory before cert expiry.
- Infrastructure configurations MUST enforce hardware-backed node attestation using TPM 2.0 plugins (`tpm2`) or AWS/GCP Nitro/vTPM instance attestation.
- Engineers MUST NOT introduce fallback routines that fall back to long-lived static secrets or environment variable credentials upon Workload API disconnection.
- Code MUST strictly validate peer SPIFFE IDs against expected SPIFFE trust domains (`spiffe://<trust-domain>/<path>`) during mutual TLS (mTLS) handshakes.

## Bad vs Good Implementations
### SPIFFE Workload API Dynamic In-Memory X.509 Rotation vs Disk Secrets

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Reading static credentials from disk bypasses hardware-backed identity, creates persistent secret exposure risk, and fails to handle zero-downtime certificate rotation without process restarts.
```typescript
import * as fs from 'fs';
import * as https from 'https';

// ANTI-PATTERN: Loading long-lived certificates from mounted secrets on disk
// Vulnerable to cold-boot extraction, volume inspection, and unrotated key compromise
const serverOptions: https.ServerOptions = {
  key: fs.readFileSync('/etc/secrets/tls.key'),
  cert: fs.readFileSync('/etc/secrets/tls.crt'),
  ca: fs.readFileSync('/etc/secrets/ca.crt'),
  requestCert: true,
  rejectUnauthorized: true,
};

export const server = https.createServer(serverOptions, (req, res) => {
  res.writeHead(200);
  res.end('Authenticated via static credential');
});
server.listen(8443);
```

#### Production Standard (Correct)
> **Standard**: Implements an in-memory TLS context manager that streams sub-hour X.509 SVIDs directly from the SPIRE Workload API over a Unix Domain Socket, rotating cryptographic materials dynamically with zero disk I/O.
```typescript
import * as https from 'https';
import * as tls from 'tls';
import { WorkloadApiClient } from '@spiffe/workload-api';

class SpiffeTlsContextManager {
  private secureContext: tls.SecureContext | null = null;
  private readonly client: WorkloadApiClient;
  private readonly expectedTrustDomain = 'spiffe://internal.mesh.prod';

  constructor(socketPath: string = 'unix:///run/spire/sockets/agent.sock') {
    this.client = new WorkloadApiClient({ socketPath });
  }

  public async initialize(): Promise<void> {
    // Stream X.509 SVIDs dynamically from SPIRE agent over local UDS
    const svidStream = await this.client.watchX509Context();

    svidStream.on('data', (x509Context) => {
      const defaultSvid = x509Context.getDefaultSvid();
      const trustBundle = x509Context.getTrustBundleForDomain(this.expectedTrustDomain);

      // In-memory atomic update; private key NEVER touches disk storage
      this.secureContext = tls.createSecureContext({
        key: defaultSvid.privateKey,
        cert: defaultSvid.certificateChain,
        ca: trustBundle.certificates,
        minVersion: 'TLSv1.3'
      });
    });

    svidStream.on('error', (err) => {
      // Fail closed: Log alertable fatal error for monitoring systems
      process.stderr.write(`SPIRE Workload API Stream Error: ${err.message}\n`);
    });
  }

  public getSecureContext(): tls.SecureContext {
    if (!this.secureContext) {
      throw new Error('TLS SecureContext not initialized from SPIRE Workload API.');
    }
    return this.secureContext;
  }
}

export async function bootstrapServer(): Promise<https.Server> {
  const manager = new SpiffeTlsContextManager();
  await manager.initialize();

  return https.createServer({
    SNICallback: (_servername, cb) => {
      try {
        cb(null, manager.getSecureContext());
      } catch (err) {
        cb(err as Error, undefined);
      }
    },
    requestCert: true,
    rejectUnauthorized: true
  }, (req, res) => {
    res.writeHead(200);
    res.end('Hardware-Attested Zero-Trust Session Established');
  });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

SPIFFE Workload Validator MCP
Validates SPIFFE ID syntax, SVID TTL constraints, and SPIRE Agent socket configuration in microservice deployment manifests.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

spire-agent
CLI tool for testing local agent connectivity, inspecting active X.509 SVIDs, and validating hardware TPM attestation.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail

SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces sub-hour TPM-attested X.509 SVID (SPIFFE Verifiable Identity Document) issuance and strictly in-memory cryptographic rotation via the SPIRE Workload API. Prohibits static cloud IAM service account keys, long-lived certificates, and disk-persisted private keys in zero-trust mesh architectures. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID Stream Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPersisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID StreamCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Services MUST connect exclusively to the SPIRE Agent via a POSIX Unix Domain Socket (e.g., `unix

Services MUST connect exclusively to the SPIRE Agent via a POSIX Unix Domain Socket (e.g., `unix:///run/spire/sockets/agent.sock`) to fetch X.509 SVIDs.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST configure SVID maximum Time-To-Live (TTL) to 3600 seconds (1 hour) or lower, targeting a default 10-to-30 minute window.

Engineers MUST configure SVID maximum Time-To-Live (TTL) to 3600 seconds (1 hour) or lower, targeting a default 10-to-30 minute window.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Cryptographic private keys and certificates MUST NEVER be serialized, cached, or written to physical or virtual disk storage (e.g., `/tmp`, ephemeral volumes).

Cryptographic private keys and certificates MUST NEVER be serialized, cached, or written to physical or virtual disk storage (e.g., `/tmp`, ephemeral volumes).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST maintain an active gRPC streaming watcher on the Workload API (`FetchX509SVID`) and hot-reload TLS contexts dynamically in memory before cert expiry.

Services MUST maintain an active gRPC streaming watcher on the Workload API (`FetchX509SVID`) and hot-reload TLS contexts dynamically in memory before cert expiry.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Infrastructure configurations MUST enforce hardware-backed node attestation using TPM 2.0 plugins (`tpm2`) or AWS/GCP Nitro/vTPM instance attestation.

Infrastructure configurations MUST enforce hardware-backed node attestation using TPM 2.0 plugins (`tpm2`) or AWS/GCP Nitro/vTPM instance attestation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Engineers MUST NOT introduce fallback routines that fall back to long-lived static secrets or environment variable credentials upon Workload API disconnection.

Engineers MUST NOT introduce fallback routines that fall back to long-lived static secrets or environment variable credentials upon Workload API disconnection.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
7

Code MUST strictly validate peer SPIFFE IDs against expected SPIFFE trust domains (`spiffe

Code MUST strictly validate peer SPIFFE IDs against expected SPIFFE trust domains (`spiffe://<trust-domain>/<path>`) during mutual TLS (mTLS) handshakes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is SPIFFE/SPIRE Hardware-Attested Workload Identity Rotation Guardrail critical for AI coding assistants?

Enforces sub-hour TPM-attested X.509 SVID (SPIFFE Verifiable Identity Document) issuance and strictly in-memory cryptographic rotation via the SPIRE Workload API. Prohibits static cloud IAM service account keys, long-lived certificates, and disk-persisted private keys in zero-trust mesh architectures. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting Long-Lived Credentials to Disk or Bypassing Workload API In-Memory SVID Stream) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

SPIFFE/SPIRE