JIT single-use tokens

Makes an issued token single-use for SPIFFE workloads: the AS revokes it at /introspect after the first successful check.

• Control id: jit_single_use
• Shape: floor. An OR across the own row and every matching binding.
• Entry points: token
• Phases: token_exchange
• Enforced at: as

Policy data

pbac.operator.controls.jit_single_use

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-jit-single-use.v1.json

Setting	Type	Default
jit_single_use	boolean	none in the schema

Reads

• context.client.registration_type
• context.actor.spiffe.trust_domain

Emits

• jit_single_use

Reason codes

This control emits no reason code.

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.jit_single_use	opa/policies/pbac/controls/jit_single_use.rego	decides
rego_fragment	pbac.controls.spiffe	opa/policies/pbac/controls/spiffe.rego	decides