magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

credential-verb

A deny rule: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead.

What it catches

An agent minting, printing, rotating or revoking a credential through the CLI.

Why

An agent holds the token it was given, and a session that mints another holds a grant nobody handed it. Refused: the console and connector token create and revoke commands, magus graph export --open --follow (its link carries a sign-in code), and magus config token print, generate and revoke, the operator token that reaches token management. It holds however the binary is spelled: ./magus, a path, go run ./cmd/magus, or inside a $(...) substitution. This is a seatbelt for a harness that opted in, not a boundary: a process running as the user can reach the same files.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [credential-verb]: ...

magus describe rule credential-verb prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

  • All rules - what this workspace enforces, deny first
  • The guard - how a verdict is reached and wired
guardrulescredential-verbdeny
Last updated (f0d4ffc9)
Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. See spells.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.