SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Bypassing SPIRE Workload API via Static File Mounts, Pre-Shared API Keys, or Unvalidated TLS Peer SANs) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard

--- description: SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard - Enforces zero-trust workload authentication via dynamic, kernel-attested SPIFFE/SPIRE Workload API Unix Domain Sockets, eliminating static secrets and long-lived credentials. Requires all microservice network transports to establish mTLS using short-lived X.509 SVIDs that rotate autonomously in-memory with strict SPIFFE ID Subject Alternative Name (SAN) verification. globs: src/**/*.{ts,tsx,js,jsx}, infra/**/*.{ts,js}, lib/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-x509-svid-workload-attestation" --- # SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing SPIRE Workload API via Static File Mounts, Pre-Shared API Keys, or Unvalidated TLS Peer SANs ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Workload Identity Standard. Mandate dynamic X.509 SVID attestation via local SPIRE Agent Unix Domain Sockets. Prohibit all static API keys, pre-shared tokens, disk-mounted long-lived private keys, and non-rotational TLS contexts. ## Strict Guidelines - Engineers MUST ALWAYS fetch cryptographic identities via the local SPIRE Agent Workload API Unix Domain Socket (e.g., 'unix:///run/spire/sockets/agent.sock'). - Engineers MUST NOT persist SVID private keys, certificates, or intermediate bundles to physical disks, environment variables, or external storage volumes. - Code MUST consume dynamic X509Source/watcher abstractions that continuously update TLS contexts in-memory before SVID expiration (< 1 hour TTL) without restarting the host process. - Services MUST validate peer identities during mTLS handshakes by explicitly verifying the SPIFFE ID URI Subject Alternative Name (SAN) against the authorized trust domain and workload path. - Components NEVER fall back to unencrypted HTTP, static tokens, or permissive TLS configurations when the SPIRE agent socket is unreachable; connections MUST fail closed with exponential backoff. ## Bad vs Good Implementations ### mTLS Transport Configuration: Static Certs vs SPIRE Agent Workload API Dynamic SVID #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Bypasses SPIRE kernel attestation. Uses long-lived static keys stored on the filesystem which are susceptible to exfiltration, requires node/pod restarts for rotation, and fails to assert the peer's SPIFFE ID SAN, enabling lateral movement if the CA is compromised. ```typescript import https from 'node:https'; import fs from 'node:fs'; // ANTI-PATTERN: Static long-lived secrets from disk/env with permissive SAN validation const options: https.AgentOptions = { cert: fs.readFileSync('/etc/ssl/certs/service.crt'), key: fs.readFileSync('/etc/ssl/private/service.key'), ca: fs.readFileSync('/etc/ssl/certs/ca.crt'), // Flaw: Static credentials do not rotate without restarts and lack SPIFFE ID SAN validation rejectUnauthorized: true, }; export const staticHttpClient = https.request('https://payments.internal.net:8443', options); ``` #### Production Standard (Correct) > **Standard**: Attests cryptographic identity via the kernel-level SPIRE Agent socket. Private keys remain memory-only with short lifetimes (< 1 hour), rotate autonomously via the X509Source watcher without process restarts, and enforce strict peer SPIFFE ID SAN matching during mTLS negotiation. ```typescript import tls from 'node:tls'; import { WorkloadApiClient, X509Source } from '@spiffe/spiffe-id'; // PRODUCTION FIX: Attest via local SPIRE Agent socket with auto-rotated SVIDs and strict SPIFFE ID SAN validation const SPIRE_SOCKET_PATH = 'unix:///run/spire/sockets/agent.sock'; const EXPECTED_PEER_SPIFFE_ID = 'spiffe://prod.internal/ns/payments/sa/payment-engine'; export async function createSpireSecuredAgent(): Promise<tls.SecureContextOptions> { const client = new WorkloadApiClient({ socketPath: SPIRE_SOCKET_PATH }); const x509Source = await X509Source.create(client); // Obtain dynamically attested short-lived SVID (< 1 hour TTL) with continuous in-memory rotation const svid = await x509Source.getX509Svid(); const bundle = await x509Source.getX509Bundle('spiffe://prod.internal'); return { cert: svid.certBuffer, key: svid.privateKeyBuffer, ca: bundle.caCertBuffers, checkServerIdentity: (host, cert) => { const sanUris = (cert.subjectaltname || '') .split(',') .map(entry => entry.trim()) .filter(entry => entry.startsWith('URI:')) .map(entry => entry.replace('URI:', '')); if (!sanUris.includes(EXPECTED_PEER_SPIFFE_ID)) { return new Error(`SPIFFE ID Mismatch: Expected ${EXPECTED_PEER_SPIFFE_ID}, found ${sanUris.join(', ')}`); } return undefined; } }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard

SPIFFE/SPIRE Workload Identity X.509 Short-Lived SVID Attestation Standard defines an industrial-grade behavioral standard for security engineering. Enforces zero-trust workload authentication via dynamic, kernel-attested SPIFFE/SPIRE Workload API Unix Domain Sockets, eliminating static secrets and long-lived credentials. Requires all microservice network transports to establish mTLS using short-lived X.509 SVIDs that rotate autonomously in-memory with strict SPIFFE ID Subject Alternative Name (SAN) verification. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing SPIRE Workload API via Static File Mounts, Pre-Shared API Keys, or Unvalidated TLS Peer SANs Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing SPIRE Workload API via Static File Mounts, Pre-Shared API Keys, or Unvalidated TLS Peer SANs	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS fetch cryptographic identities via the local SPIRE Agent Workload API Unix Domain Socket (e.g., 'unix

Engineers MUST ALWAYS fetch cryptographic identities via the local SPIRE Agent Workload API Unix Domain Socket (e.g., 'unix:///run/spire/sockets/agent.sock').

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.