Hardening checklist

Not a certification and not exhaustive — a floor. Treat it as the minimum a deployment should clear before agents touch production resources through it.

Policy

• policy.fail_closed is true, and changing it requires a second reviewer
• A forbid guardrail exists for every resource whose exposure would be a real incident, not just a permit for what's currently needed
• Policy unit tests run in CI on every change to the rule set
• expectNoLoosening — or cirvix replay against a recorded run — runs before merge, not just after an incident

Identity

• Production-facing agents run on attested infrastructure, not developer laptops
• Approvers and groups are federated from your IdP, not managed as a second source of truth
• Every agent has an owner — cirvix scan reports orphaned identities

Secrets

• No raw secret values in an agent's environment or context — handles only
• Handle-to-destination allowlists are scoped as narrowly as the integration allows
• Vault-native rotation still runs; handles don't change your rotation story

Network

• egress.deny_private_ranges is true
• The gateway is the only path agent traffic takes out of its environment
• Egress allowlists are checked at resolved-IP level, not hostname alone

Audit

• cirvix audit verify runs on a schedule, not only when something looks wrong
• An export has been test-run against the actual control it's meant to satisfy, before an auditor asks for it
• A SIEM stream is connected — the dashboard is not the only place evidence lives

Approvals

• Timeout and escalation are configured explicitly, not left at defaults nobody reviewed
• A forgotten hold fails closed
• Approval group membership is reviewed on the same cadence as any other access grant