Operations & security
Emergency containment
Stop access safely while preserving a recovery path and evidence.
Containment is appropriate when an identity, credential, host, integration, or trust anchor may be compromised.
First actions
- Confirm the affected tenant, people, credentials, hosts, and time window.
- Preserve at least one independent administrative recovery path.
- Contain the narrowest safe scope in Tenvyr.
- Revoke active credentials or access where supported.
- Verify that new SSH authentication fails.
- Export and preserve relevant audit events.
Do not begin by deleting evidence or removing the only remaining administrator.
Choose the scope
| Incident | Initial containment |
|---|---|
| One user or SCIM identity | Contain the actor; revoke credentials and sessions |
| Exposed enrollment token | Let it expire or consume safely; investigate any host created from it |
| Exposed SCIM token | Rotate the connector token immediately |
| Compromised OIDC secret | Replace it in Tenvyr, test, then revoke it at the provider |
| One suspect host | Remove it from access scope and revoke/contain its host identity |
| Suspect host-group CA | Begin trust rotation for that host group |
| Policy error | Disable or narrow the policy and inspect affected grants |
Validate containment
Check both control and data paths:
- Tenvyr rejects new access requests or credential issuance;
- direct OpenSSH authentication no longer accepts the affected identity;
- agents continue reporting where evidence collection requires it;
- SIEM delivery still works; and
- emergency administrators can still reach the host.
Recover deliberately
Recovery is a new authorization decision. Establish root cause, rotate affected secrets or trust, review identity state, and re-enable the smallest scope first. Document who approved restoration and which tests were completed.