Post-quantum workload identity. Enrolling generates a real ML-DSA-65 identity key and an ML-KEM-768 session key; policy denies any credential signed by an algorithm Shor breaks. Revocations persist across restarts, and every attestation, revocation and access decision is written to an audit trail.
Status and attestation metadata are read from the database, so they survive a restart.
No services enrolled.
The gate accepts only a currently valid proof: right audience, unexpired, verified against the enrolled public key, identity neither revoked nor unenrolled. Every allow and deny is written to the audit trail below.
No proof in hand. Use Attest in the inventory to mint one.
No audit events yet. Enrolling, attesting, revoking and requesting access all start the trail.
Refused: …
Ask the authority what it would do with a given signature algorithm.