Token TTL override

Shortens the lifetime of an issued token for SPIFFE workloads. Composes as a minimum across every contributor, so it lowers a TTL and never raises one.

• Control id: token_ttl
• Shape: scalar. Takes the minimum across the own row and every matching binding.
• Entry points: token
• Phases: token_exchange
• Enforced at: as

Policy data

pbac.operator.controls.token_ttl

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-token-ttl.v1.json

Setting	Type	Default
ttl_override	integer	none in the schema

Reads

• context.client.registration_type
• context.actor.spiffe.trust_domain

Emits

• expires_in_override

Reason codes

This control emits no reason code.

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.token_ttl	opa/policies/pbac/controls/token_ttl.rego	decides
rego_fragment	pbac.controls.spiffe	opa/policies/pbac/controls/spiffe.rego	decides