Credential Rotation — 90 Day

Enforce credential freshness by tracking credential age and blocking requests that use expired credentials. Agents receive a warning at 75 days and are denied at 90 days, with approval-gated access during the warning window.

Policy JSON

{
  "secrets": {
    "enabled": true,
    "credential_ttl": {
      "enabled": true,
      "max_age_days": 90,
      "warning_days": 75,
      "action_on_expired": "DENY",
      "action_on_warning": "REQUIRE_APPROVAL"
    }
  }
}

policy = {
    "secrets": {
        "enabled": True,
        "credential_ttl": {
            "enabled": True,
            "max_age_days": 90,
            "warning_days": 75,
            "action_on_expired": "DENY",
            "action_on_warning": "REQUIRE_APPROVAL",
        },
    }
}

What It Does

Tracks credential creation dates and calculates age against the configured TTL
Warns at 75 days by requiring human approval before the agent can use the credential
Denies at 90 days — expired credentials are blocked entirely
Integrates with TealAudit to log rotation events and compliance status

Example

Agent attempts to use a credential created 82 days ago: Decision object:

{
  "action": "REQUIRE_APPROVAL",
  "risk_score": 0.7,
  "reasons": ["credential_rotation_warning"],
  "evidence": {
    "credential_id": "api-key-prod-openai",
    "age_days": 82,
    "max_age_days": 90,
    "warning_days": 75,
    "days_until_expiry": 8,
    "status": "warning"
  }
}

Install

# Install via CLI
tealtiger policy install credential-rotation-90day

# Or copy the JSON above into your tealtiger.config.json

Customize

Setting	Default	Description
`max_age_days`	`90`	Maximum credential age before denial. Common values: 30, 60, 90, 365
`warning_days`	`75`	Days before warning triggers. Set to `max_age_days - 15` as a rule of thumb
`action_on_expired`	`DENY`	Action when credential exceeds max age
`action_on_warning`	`REQUIRE_APPROVAL`	Action during warning window. Options: `REQUIRE_APPROVAL`, `MONITOR`, `DENY`

For SOC 2 compliance, set max_age_days to 90. For PCI DSS, use 90 or stricter. For internal development environments, 365 is a reasonable starting point.

API Key Detection — Detect leaked credentials in agent I/O
Cloud Secrets — AWS — AWS-specific credential management
SOC 2 Basic Pack — Includes credential rotation requirements
TealSecrets Documentation — Full API reference

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Credential Rotation — 90 Day

Policy JSON

What It Does

Example

Install

Customize

​Policy JSON

​What It Does

​Example

​Install

​Customize

​Related

Policy JSON

What It Does

Example

Install

Customize

Related