Production readiness checklist

Use this checklist as an evidence-gathering gate, not a one-time form.

Identity

• Two controlled local owners can recover the tenant.
• OIDC is limited to the intended directory and pilot assignment.
• Tenvyr MFA has been tested for local and OIDC users.
• SCIM externalId uses immutable provider object IDs.
• Deactivation and explicit reactivation behavior has been tested.
• OIDC and SCIM secret owners and rotation dates are recorded.

Authorization

• Tenant roles follow least privilege.
• Access policies use bounded host groups and durations.
• Approval paths work when a normal approver is absent.
• Privilege profiles have been reviewed on every supported OS.
• Access-review owners and due dates are defined.

Hosts

• Host groups match real trust boundaries.
• Enrollment uses unique ten-minute, single-use tokens.
• Package signatures and checksums are verified.
• Lab and canary rollback succeeded.
• Agent heartbeat, host keys, and desired-state validation are monitored.
• Independent emergency SSH access is tested.

Platform

• Application, agent, SCIM, and documentation origins are separated.
• TLS, DNS, time synchronization, and egress paths are monitored.
• Database restore has been tested.
• Encryption and signing keys have named custodians.
• A host-group CA rotation has been rehearsed.

Detection and response

• Audit exports reach the SIEM and signatures are validated.
• Alerts cover failed sign-ins, credential changes, containment, and agent health.
• Emergency containment was exercised without losing the recovery path.
• Incident responders know how to preserve Tenvyr and host evidence.

Operations

• Supported versions and upgrade ownership are documented.
• Deployment waves have halt thresholds.
• Exceptions have owners and expiration dates.
• Documentation and runbooks match the production configuration.

Record evidence links and the approving owner outside this public checklist.