Who can do what, and what to take away

Where to find it

Under Access review in the workspace sidebar, or with tilldev access review. Owners and admins can read it, including someone holding time-boxed admin. It’s worked out each time you open it, so a fix shows up straight away.

The top of the page counts members, owners, admins, people without an authenticator and live credentials by kind.

What it looks for

A member counts as active when they sign in or their session renews. Someone with no record of activity counts from the day they joined. A second factor means an authenticator added on the Profile page; a passkey used only for approvals isn’t counted, and sign-in through your company’s identity provider isn’t visible to the review.

Which credentials it covers

• API key (api_key)
• TillSecrets service token (secrets_token)
• TillSecrets agent token (secrets_agent)
• TillForge access token (forge_token)
• TillForge SSH key or deploy token (forge_key)
• TillCache token (cache_token)
• TillArk token (ark_token)
• TillNotary token (notary_token)
• TillShield edge key (edge_key)

Revoked and expired credentials are left out. A credential counts as used when a request presents it.

Fixing a finding

Each fix is an ordinary request to the API, the same one the rest of the dashboard sends, so it follows the same rules: only an owner can demote an owner, the last owner can’t be removed, and making someone eligible for time-boxed admin needs an approval. In the dashboard, revoking or removing asks you to confirm first; in the CLI, add --yes.

tilldev access review                        # inventory, then findings, most serious first
tilldev access review --level high
tilldev access review --fail-on high --json   # exit 1 if anything high is open

tilldev access review fix authz-stale-admin:member:5b0c…               # every step, in order
tilldev access review fix authz-stale-admin:member:5b0c… --step 1      # only the first
tilldev access review fix authz-orphaned-credential:api_key:9f1e… --yes   # revokes and removals ask first

Keeping something on purpose

A break-glass owner who rarely signs in, or a deploy key that runs once a quarter, can be right. Accept the finding with a reason of at least 10 characters, for 90 days by default and 366 at most. It moves to Accepted with the reason and who accepted it, and returns to the list when that time runs out. Accepting it again renews it.

• Accepting needs a standing owner or admin and an approval; time-boxed admin can’t accept anything.
• Only an owner can accept a high finding.
• Nobody can accept a finding about themselves.

tilldev access review accept authz-sole-owner:workspace \
  --reason "two founders; the second is on leave until March" --days 90
tilldev access review accepted
tilldev access review unaccept 3c2a…

How quiet is too quiet

tilldev access review settings                                 # show
tilldev access review settings --admin-days 14 --credential-days 60

The record

Every fix is recorded by the endpoint it calls. Role changes and removals from the workspace, changes to the two-factor requirement, accepted findings, removed acceptances and threshold changes are in the workspace audit log and the security event stream. Moving someone into owner or admin raises a high finding in TillTell.

From the API

The endpoints are under Access in the API reference. They take a signed-in session; an API key gets 401.

curl -s https://tilldev.dev/api/access/review -H "authorization: Bearer $SESSION"

# Each finding carries the requests that fix it
# { "id": "authz-stale-admin:member:5b0c…", "level": "medium", "fixes": [
#   { "label": "Move to developer", "method": "PATCH", "path": "/api/team/5b0c…", "body": { "role": "developer" } },
#   { "label": "Let them ask for admin", "method": "PUT", "path": "/api/access/eligibility/5b0c…", "body": { "max_minutes": 60, "approval": "peer" } } ] }