Enterprise Integration exit conditions
Candidate exit conditions for the Enterprise Integration type. See the catalog overview for how to adopt these, and /akka:harnesses for the generator that produces the assets these conditions verify.
This type covers the plumbing surfaces — identity, secrets vault, SIEM, artifact registry, service catalog — that do not fit the other types and are almost entirely provisioned or delegated. A provisioned condition verifies a generated harness asset is current and enforcing; a delegated condition resolves on a recorded attestation.
|
This is a defined, tiered Definition-of-Done type, but it ships no default-library conditions yet. Today it is satisfied by the vault, SIEM, and registry plumbing you provision as harness assets, verified against |
Identity and access integration
| Exit condition | What it checks |
|---|---|
|
The service authenticates against the mandated identity provider, not a local store. |
|
Single sign-on is required for privileged access paths, verified where inspectable. |
|
Machine identities are scoped to least privilege and recorded in the directory. |
Secrets and supply chain
| Exit condition | What it checks |
|---|---|
|
Secrets resolve from the mandated vault rather than from committed files or environment defaults. |
|
The vault harness matches the current policy version and surface signature in |
|
Build artifacts publish to the mandated registry with the required signing step enforced. |
Telemetry and catalog integration
| Exit condition | What it checks |
|---|---|
|
Security-relevant logs forward to the mandated SIEM, attested where the endpoint is unreachable by the plugin. |
|
The service is registered in the enterprise service catalog with an owner recorded. |
|
Each delegated integration the plugin cannot inspect carries a recorded attestation covering the current state. |