Agent credential rotation · Software Development

Routing5

at Build

RSH2/2
Discovery
Anselm Reyes
Complete
✓
ENG2/2
Specification
Aris Vandel
Complete
ENG1/4
Build
Aris Vandel
Blocked
Four standing credentials belong to a vendor whose API caps rotation at 10 calls/hour. Rotation cannot complete inside the maintenance window until that cap is lifted.
◇
ENG0/2
Quality assurance
Aris Vandel
Pending
★
OPS0/1
Release
Mira Halvorsen
Pending

Ready to start3

3 waiting

Wire the approval hook to the executive queueBuild Runner
Rotate the four vendor-held credentialsCipher Vale
Attribution audit — every grant names an approverCipher Vale

Held behind a dependency

Revoke every remaining standing grant×2
Verify no residual access after revocation×2
Roll out family by family×2

Assigned teams3

Departments, in routing order

Accountable

Executive Rhea KastellanManagers Anselm Reyes, Aris Vandel, Mira Halvorsen

AI agents on this workflow

Stage timeline

STAGE 1
Discovery
Complete32h planned
Find every standing credential and who uses it.
ResearchManager Anselm Reyes1 agent: Archivist
2 of 2 tasks100%
STAGE 2
Specification
Complete48h planned
Design the rotation service and the approval path.
EngineeringManager Aris Vandel1 agent: Cipher Vale
2 of 2 tasks100%
Manager approvalApproved28 Jun 2026
Approve the rotation design and approval path.
Held by Aris Vandel
Approved on condition that no grant issues without a named approver.
STAGE 3
Build
Blocked160h planned
Implement rotation, scoping and the approval hook.
EngineeringManager Aris Vandel2 agents: Cipher Vale, Build Runner
1 of 4 tasks25%
Blocked — Four standing credentials belong to a vendor whose API caps rotation at 10 calls/hour. Rotation cannot complete inside the maintenance window until that cap is lifted.
STAGE 4
Quality assurance
Pending48h planned
Prove no agent retains access after revocation.
EngineeringManager Aris Vandel1 agent: Probe
0 of 2 tasks0%
QA approvalPending22 Aug 2026
Confirm zero residual access fleet-wide.
Held by Probe
STAGE 5
Release
Pending32h planned
Roll out fleet-wide, family by family.
OperationsManager Mira Halvorsen
0 of 1 tasks0%
CEO approvalPending29 Aug 2026
Authorise fleet-wide credential cutover — irreversible for standing grants.
Held by CEO

Dependencies

Discovery

2

Inventory standing credentials across the fleet

Completed·Cipher Vale

Unlocks 1 task

Map each credential to an owning agent family

Completed·Archivist

Unlocks 1 task

Specification

2

joins from Discovery

Design the rotation service

Completed·Cipher Vale

Unlocks 1 task

Specify the named-approver hook

Completed·Cipher Vale

Unlocks 1 task

Build

4

joins from Specification

Implement short-lived grant issuance

Completed·Cipher Vale

Unlocks 1 task

Wire the approval hook to the executive queue

In progress·Build Runner

Ready — every dependency closed

Unlocks 1 task

Rotate the four vendor-held credentials

Blocked·Cipher Vale

Ready — every dependency closed

Unlocks 1 task

Revoke every remaining standing grant

Backlog·Cipher Vale

Waiting on 1: Rotate the four vendor-held credentials

Unlocks 1 task

Quality assurance

2

joins from Build

Verify no residual access after revocation

Backlog·Probe

Waiting on 2: Wire the approval hook to the executive queue; Revoke every remaining standing grant

Unlocks 1 task

Attribution audit — every grant names an approver

Backlog·Cipher Vale

Ready — every dependency closed

Unlocks 1 task

Release

1

joins from Quality assurance

Roll out family by family

Backlog·Operations

Waiting on 2: Verify no residual access after revocation; Attribution audit — every grant names an approver

One column per stage, in routing order. Tasks inside a stage run in parallel; the first task of each stage joins from every task of the one before it, which is the hand-off between departments made explicit.

Board11

Backlog

4

Revoke every remaining standing grant

Criticalbuildwaiting ×2

Cipher Vale19 Aug

Verify no residual access after revocation

Criticalqawaiting ×2

Probe22 Aug

Attribution audit — every grant names an approver

Highqa

Cipher Vale25 Aug

Roll out family by family

Highreleasewaiting ×2

Operations29 Aug

To do

0

Empty

In progress

1

Wire the approval hook to the executive queue

Highbuild

Build Runner08 Aug

Review

0

Empty

Blocked

1

Rotate the four vendor-held credentials

Criticalbuild

Cipher Vale12 Aug

Completed

5

Inventory standing credentials across the fleet

Criticalaudit

Cipher Vale09 Jun

Map each credential to an owning agent family

Highaudit

Archivist12 Jun

Design the rotation service

Criticalspec

Cipher Vale24 Jun

Specify the named-approver hook

Highspec

Cipher Vale27 Jun

Implement short-lived grant issuance

Criticalbuild

Cipher Vale18 Jul

Approval gates3

2 open

Manager approvalApprovedNot reached27 Jun 2026

Agent credential rotation

Approve the rotation design and approval path.

Stage SpecificationEngineeringHeld by Aris Vandel

Approved on condition that no grant issues without a named approver.

QA approvalPendingNot reached22 Aug 2026

Agent credential rotation

Confirm zero residual access fleet-wide.

Stage Quality assuranceEngineeringHeld by Probe

CEO approvalPendingNot reached29 Aug 2026

Agent credential rotation

Authorise fleet-wide credential cutover — irreversible for standing grants.

Stage ReleaseOperationsHeld by CEO

Deciding a gate writes the decision and nothing else. The status change, the release of downstream stages and the “ready to close” state are all derived from it on the next render — which is why an approval here is one field rather than a transaction.

Memory links2

Messages2

Cipher Vale5h ago
Vendor cap is 10 rotations an hour. We need 340. That is not a maintenance window, that is a fortnight.
Open in the Hub →
Aris Vandel1d ago
Escalating the rate limit to the vendor's account team. Everything else is ready to go.
Open in the Hub →

Related projects1

Agent credential rotation service44%
Engineering

Performance

320h planned · 184h remaining

45%

Progress

5 of 11 tasks

2/5

Stages closed

1/3

Gates cleared

1

Blocked tasks

3

Departments

routed through

4

Agents

named on the work

184h

Remaining

from the breakdown

—

Estimate variance

on plan

Task completion45%

Task-weighted, not stage-weighted. A two-hour approval stage and a two-hundred-hour build stage are not half the work each, and treating them as such is the usual way a project dashboard reports 50% before anything has been built.

Completion rule · All stages complete

Closed when every agent family runs on short-lived grants and the audit shows zero standing credentials.

Every stage reaches complete or skipped.

Automation7

1 would fire · 0 will

Next routing decisionHeld

Four standing credentials belong to a vendor whose API caps rotation at 10 calls/hour. Rotation cannot complete inside the maintenance window until that cap is lifted.

Computed by engine.peekAdvance(), which returns the next stage rather than moving to it. The Task Orchestrator owns the write; keeping this side pure is what lets a card show “next: Engineering” with no risk that rendering a page advances a workflow.

Advance stage on completion
WHEN
Every task in the active stage reaches a terminal column and the stage carries no pending gate.
THEN
Mark the stage complete and route work to the next stage in the chain.
NOW
3 tasks still open in Build.
Notify approver on gate open
WHEN
A stage with a gate becomes active and the gate is still pending.
THEN
Raise a workflow notification addressed to the named approver in the Communication Hub.
NOW
No gate is currently open.
Escalate a stale gate
WHEN
A gate has been pending longer than its stage's estimate.
THEN
Escalate one authority level up and notify the accountable executive.
NOW
Needs a real clock. Placeholder timestamps are relative strings.
Release dependent tasksWould fire
WHEN
A task reaches a terminal column and other tasks depend on it.
THEN
Move every newly-ready dependent from backlog into to-do.
NOW
1 backlog tasks have all dependencies closed.
Write outcome to memory
WHEN
The completion rule is satisfied.
THEN
Write a project-scope memory record summarising the outcome and link it back.
NOW
Completion rule is not satisfied yet.
Auto-approve low-risk gatesHeld for a human
WHEN
A QA or manager gate carries no rejection history and sits under the risk threshold.
THEN
Nothing. Recorded so the policy is visible and reviewable — a gate an agent can clear is not a gate.
NOW
Held for a human by design.
Stand down a stalled workflowHeld for a human
WHEN
No activity for longer than the estimated duration and no open gate explains it.
THEN
Nothing automatic. Surfaces the workflow for a human decision.
NOW
Held for a human by design.

Nothing here executes. There is no scheduler, no queue and no writer — these are evaluations of the current state, refreshed on every render. Adding a trigger is one row in AUTOMATION_TRIGGERS; it appears on every workflow immediately so a rule can be checked against real data before anything is built to act on it.

Activity log5

Cipher Vale Blocked Build — vendor API caps rotation at 10 calls/hour.
Build
5h ago
Aris Vandel Escalated the rate limit to the vendor account team.
Build
1d ago
Cipher Vale Closed short-lived grant issuance.
Build
2w ago
Aris Vandel Approved the specification gate.
Specification
5w ago
CEO Opened from the Software Development template — 5 stages, 3 approval gates.
8w ago