AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: spiffe-spire-hardware-workload-identity-federation

Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard

Enforces short-lived, hardware-rooted (TPM 2.0 / platform attestation) X.509 SVID credentials obtained dynamically via the local SPIRE Workload API. Strictly prohibits static long-lived cross-cluster API keys, shared secrets, and unrotated credentials in multi-cloud mesh architectures.

Prohibited Anti-Pattern: Hardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted Attestation

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard - Enforces short-lived, hardware-rooted (TPM 2.0 / platform attestation) X.509 SVID credentials obtained dynamically via the local SPIRE Workload API. Strictly prohibits static long-lived cross-cluster API keys, shared secrets, and unrotated credentials in multi-cloud mesh architectures.
globs: src/**/*.{ts,tsx,js,go}, infra/**/*.{yaml,yml,json}, k8s/**/*.{yaml,yml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/spiffe-spire-hardware-workload-identity-federation"
---

# Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Hardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted Attestation

## System Constraints
You are a Principal Security Architect enforcing Zero-Trust cryptographic workload identity using SPIFFE/SPIRE with hardware-rooted (TPM 2.0) node attestation. Mandate that all inter-service and cross-cluster communications establish Mutual TLS (mTLS) using dynamic X.509 SVIDs sourced directly from the local SPIRE Workload API Unix Domain Socket. Forbid static API keys, shared tokens, mounted credentials in ConfigMaps, and unverified trust bundles.

## Strict Guidelines
- Engineers MUST ALWAYS fetch X.509 SVIDs dynamically via the SPIRE Workload API Unix Domain Socket ('unix:///run/spire/sockets/agent.sock') without persisting private keys to disk.
- Engineers MUST NOT inject static cross-cluster API keys, long-lived JWTs, or shared bearer tokens into environment variables or Kubernetes Secrets.
- Code SHOULD leverage automated SVID watcher loops that hot-reload certificates prior to expiry without terminating running connections or restarting processes.
- Services MUST validate peer SPIFFE IDs against explicit Trust Domain federation bundles (e.g., 'spiffe://partner.domain/sa/backend') during TLS handshakes.
- Components NEVER accept incoming or outbound mesh traffic without bidirectional X.509 SVID verification and strict SAN URI matching matching the authorized SPIFFE ID.

## Bad vs Good Implementations
### Cross-Cluster Communication via SPIRE Workload API Client vs. Static API Key

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Relies on a static, high-entropy cross-cluster secret stored in an environment variable. If compromised, an attacker can impersonate the cluster indefinitely without hardware proof of node integrity.
```typescript
import axios from 'axios';

// ANTI-PATTERN: Long-lived static secret shared across clusters
// Vulnerable to credential leakage, lacks hardware attestation, and requires manual rotation.
const CROSS_CLUSTER_API_KEY = process.env.PARTNER_CLUSTER_STATIC_KEY;

export async function callRemoteService(endpoint: string, payload: unknown) {
  return axios.post(endpoint, payload, {
    headers: {
      'Authorization': `Bearer ${CROSS_CLUSTER_API_KEY}`,
      'X-Origin-Cluster': 'us-east-prod'
    }
  });
}
```

#### Production Standard (Correct)
> **Standard**: Retrieves short-lived cryptographic credentials directly from the local SPIRE agent over an attested Unix socket. Validates the peer's SPIFFE ID against the federated trust bundle with no static secrets persisted.
```typescript
import * as https from 'https';
import { WorkloadApiClient } from '@spiffe/spiffe-sdk';

// PRODUCTION INVARIANT: Short-lived X.509 SVID backed by TPM node attestation
const SPIRE_SOCKET_PATH = 'unix:///run/spire/sockets/agent.sock';
const EXPECTED_PEER_SPIFFE_ID = 'spiffe://partner-mesh.internal/ns/prod/sa/remote-service';

export async function createSpiffeHttpsClient(): Promise<https.Agent> {
  const client = new WorkloadApiClient({ socketPath: SPIRE_SOCKET_PATH });
  const x509Context = await client.fetchX509Context();
  const svid = x509Context.getDefaultSvid();
  const trustBundle = x509Context.getFederatedTrustBundle('partner-mesh.internal');

  return new https.Agent({
    cert: svid.certChainPem,
    key: svid.privateKeyPem,
    ca: trustBundle.bundlePem,
    checkServerIdentity: (host, cert) => {
      const uriSans = cert.subjectaltname?.split(', ').filter(s => s.startsWith('URI:')) ?? [];
      const hasValidSpiffeId = uriSans.some(uri => uri === `URI:${EXPECTED_PEER_SPIFFE_ID}`);
      if (!hasValidSpiffeId) {
        throw new Error(`SPIFFE ID mismatch: Peer identity does not match ${EXPECTED_PEER_SPIFFE_ID}`);
      }
      return undefined;
    }
  });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

SPIRE Workload API Diagnostic Server
Inspects SPIRE agent socket status, verifies node attestation TPM claims, and audits active X.509 SVID rotation schedules.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

SPIRE CLI Attestation Validator
Executes 'spire-server bundle list' and 'spire-agent api fetch' to validate cross-cluster federation and hardware attestation.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard

Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard defines an industrial-grade behavioral standard for security engineering. Enforces short-lived, hardware-rooted (TPM 2.0 / platform attestation) X.509 SVID credentials obtained dynamically via the local SPIRE Workload API. Strictly prohibits static long-lived cross-cluster API keys, shared secrets, and unrotated credentials in multi-cloud mesh architectures. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Hardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted Attestation Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftHardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted AttestationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS fetch X.509 SVIDs dynamically via the SPIRE Workload API Unix Domain Socket ('unix

Engineers MUST ALWAYS fetch X.509 SVIDs dynamically via the SPIRE Workload API Unix Domain Socket ('unix:///run/spire/sockets/agent.sock') without persisting private keys to disk.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT inject static cross-cluster API keys, long-lived JWTs, or shared bearer tokens into environment variables or Kubernetes Secrets.

Engineers MUST NOT inject static cross-cluster API keys, long-lived JWTs, or shared bearer tokens into environment variables or Kubernetes Secrets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Code SHOULD leverage automated SVID watcher loops that hot-reload certificates prior to expiry without terminating running connections or restarting processes.

Code SHOULD leverage automated SVID watcher loops that hot-reload certificates prior to expiry without terminating running connections or restarting processes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST validate peer SPIFFE IDs against explicit Trust Domain federation bundles (e.g., 'spiffe

Services MUST validate peer SPIFFE IDs against explicit Trust Domain federation bundles (e.g., 'spiffe://partner.domain/sa/backend') during TLS handshakes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER accept incoming or outbound mesh traffic without bidirectional X.509 SVID verification and strict SAN URI matching matching the authorized SPIFFE ID.

Components NEVER accept incoming or outbound mesh traffic without bidirectional X.509 SVID verification and strict SAN URI matching matching the authorized SPIFFE ID.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Hardware-Attested SPIFFE/SPIRE Workload Identity & Cross-Domain Federation Standard critical for AI coding assistants?

Enforces short-lived, hardware-rooted (TPM 2.0 / platform attestation) X.509 SVID credentials obtained dynamically via the local SPIRE Workload API. Strictly prohibits static long-lived cross-cluster API keys, shared secrets, and unrotated credentials in multi-cloud mesh architectures. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Hardcoding Static Cross-Cluster API Keys or Using Ephemeral In-Memory Secrets Lacking Hardware-Rooted Attestation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Hardware-Attested