Skip to content
Documentation menu

Core concepts · 04

KITs & devices

The KIT (Keydris Identity Token) is the short-lived identity an agent presents while operating. Your policy defines the authority; Keydris issues the KIT bound to that policy, so a governed action references the authority behind it.

What a KIT binds

KIT · the authority the agent presents

organizationacme-corp

acting forrelease-eng (user principal)

devicekd_dev_31b0 (enrolled installation)

agentkd_agt_7c2 · claude-code

policydeploy-guard · v14

scoperepo:deploy · db:read

expires17:00Z · renewed during long work

Illustrative fields. The KIT is a session identity: it says who is acting, on whose behalf, from which enrolled installation, and under which policy, so every action it accompanies can be checked and attributed.

Two identities, two lifetimes. The device identity belongs to an enrolled installation and persists across sessions. You can revoke it centrally. The KIT belongs to one running session and is short-lived by design; Keydris renews it during long-running work, so the agent never needs a long-lived credential.

What a KIT is not

Verified behavior

A KIT is not your provider credential, and the agent never receives the connected credential. The keys and secrets an action requires are held apart from the agent (in your own environment or in a Keydris-managed vault, depending on the integration mode) and are released only for an action that has already passed policy enforcement. Keydris never places them in prompts, agent configuration, or responses to the agent.

This is the difference between Keydris and handing an agent a scoped key: a compromised agent process holds no long-lived credential, only a short-lived session identity that expires on its own and fails verification once a revocation reaches the enforcement point. The exposure window is the session lifetime or the revocation taking effect, whichever ends it first.

Issuance, renewal, revocation

  • Issuance. Interactive enrollment from the CLI, or headless enrollment for automation principals: CI and production agents enroll without a human at a terminal.
  • Renewal. Session identity refreshes automatically during long-running work. No rotation calendar, no 90-day keys.
  • Revocation. Revoke a session, a device, or disable an agent centrally. Revocation is managed centrally at the Keydris platform, and no authority decision completes without Keydris: a revoked KIT fails its next verification, and anything that cannot be verified is blocked.

Take care

Revocation governs future actions only. It never reverses an action that already executed, and an action already decided is not recalled mid-flight. The audit trail keeps the full record, and nothing rewrites it. How quickly a central revocation takes effect at a given enforcement point depends on your deployment; Keydris does not publish a universal bound.