THE FIELD GUIDE / OPERATIONS
Recovery readiness & encryption-key custody
Separate backup coverage from verified restore and keep keys recoverable across rotations.
Check coverage and freshness
The readiness dashboard shows backup age, declared database, state, evidence and trust coverage, and key custody status. Archive verification, isolated restore, target boot and application checks have separate results. Drill receipts record scope, gaps and time, and stale evidence expires.
Manage key access deliberately
Use local key custody or a supported external secret provider with least-privilege access. Versioned key identities and envelopes support resumable re-encryption. Readiness checks verify matching deployment and key generations before protected work proceeds.
Prove recovery through rotation
Verify restoration of relevant backups from before and after rotation using the applicable keys and isolated destinations. Retain old keys according to the recovery policy, and audit retirement and revocation. Missing keys or unavailable providers block protected operations with redacted diagnostics.
Open the application reference for capability scope and technical details.
Open View scope in issue #345 ↗