Secrets infrastructureLifecycle
Recovery and rotation
Recover access, rotate the master recipient group, and handle emergency access as explicit audited operations.
Recovery and rotation — contract and behavior
- Every item carries a recovery recipient so loss of the daily identity does not destroy the encrypted data.
- Master rotation re-encrypts items to a fresh recipient group; a full re-key can replace the underlying data keys.
- Emergency access is an operator procedure with durable audit evidence, not a hidden bypass in the local API.
- Recovery material must be stored separately from the daily host and tested without exposing production plaintext.