Require a written reason for sensitive actions

tovio policy audittovio policy audit --require-for obliterate --minimum-length 40tovio policy audit --require-for obliterate --require-for token-revoketovio policy audit --reset

Requires a written justification before selected security-sensitive mutations, recorded in the signed audit chain. With no options the command is read-only — it shows the active declaration. --minimum-length sets a floor, from 1 to 4096 characters after trimming, so "fix" does not count.

Supplying the reason

tovio --justification "INC-4412: rotating the leaked deploy key" key rotate

--justification is a global flag, not one per command. If policy requires a reason for the mutation you are running and the flag is absent, blank after trimming, or shorter than the floor, the command is refused before the mutation, with TVO-PERM-005.

The events you can require it for

--require-for is repeatable and replaces the selected set — it does not add to it. List every event you want in one invocation. The authoring surface is deliberately bounded to events that have a pre-mutation gate at the dispatcher:

• policy-change
• identity-init
• obliterate
• token-issue
• token-revoke
• key-import
• key-recover
• key-rotate
• device-enroll
• device-revoke

That list is the whole surface. Breaking a lock, moving a tag, and landing a change are not authorable here, because requiring a reason at a point that is not gated before the mutation would be a prompt, not a control.

What to require it for

Sparingly, and only where the reason is genuinely non-obvious six months later: obliteration, key recovery, revoking a token mid-incident. Requiring one on every event in the list produces a log full of "routine rotation" and teaches everyone to ignore the prompt.

Loosening it is itself gated

Changing or resetting the policy is a policy-change, and it is evaluated against the current policy before the replacement is written. If policy-change is in the required set, you cannot quietly remove the requirement — removing it is itself an audited, justified act.

What it is worth

Six months later, the audit entry says who obliterated the object and why they thought it was safe. That second half is the part no automated record can reconstruct.

Reading them back

tovio audit logtovio audit show --object <hash>

Related controls

tovio policy signing --require-commitstovio policy hook add <event> <plugin_id>