Require a justification for sensitive operations

Some operations can be made to require a written reason before they are allowed to proceed. The reason is recorded in the signed audit chain, so "why did we rotate that key in March" has an answer that is not a chat log.

tovio policy audit

With no options this reports the current declaration.

Requiring justifications

tovio policy audit --require-for policy-change --require-for key-rotate

tovio policy audit --require-for obliterate --minimum-length 40

--require-for is repeatable and replaces the selected set rather than adding to it — list every event you want each time. --minimum-length sets the floor in trimmed characters, between 1 and 4096.

The events you can select

policy-change, obliterate, token-issue, token-revoke, key-rotate, device-enroll, device-revoke, and also identity-init, key-import and key-recover. The set is deliberately closed; it does not cover every audit event.

Supplying one

tovio --justification "Rotating after the vendor breach, ticket SEC-4412" key rotate

--justification is a global flag, so it is accepted before or after the subcommand. Omit it when policy requires it and the operation is refused with TVO-PERM-005 before anything mutates.

The lockout worth knowing about

Once policy-change is in the required set, reading the declaration counts as a policy change. Even a bare tovio policy audit with no options is denied without a justification.

This is not a bug you can wait out. Pass one:

tovio --justification "Reviewing the audit justification policy" policy audit

The same applies to loosening or resetting it, so keep a justification handy whenever you touch this command.

Turning it off

tovio --justification "…" policy audit --reset

--reset removes the declaration and cannot be combined with the authoring options. Selecting an empty event set normalizes to no declaration at all, and --minimum-length on its own when no policy is set is a silent no-op that does not remember the number.

Enable it deliberately

The first enable is checked against the old policy, so it is admitted without a justification. Every subsequent change is not. Decide the event set before you run it.