Hardening checklist

A default install favours getting started. A deployment that will be assessed against enterprise risk controls should work through this list. Each item links to the page that explains the setting, its default and what it changes for users.

Supply chain

• Verify the signature and build provenance of the chart and images before you install or upgrade. Enforce the signature with an admission policy, so the cluster refuses an image the Elitea release workflow did not sign. See Verify release artifacts.
• Import the image SBOMs into your vulnerability management, so a new CVE in a shipped package reaches you between releases.

Identity and credentials

• Use SSO (OIDC or SAML) and SCIM provisioning. Assign project roles through groups, not by hand. See Authentication.
• Turn on the credential governance profile, so agents run under their own identity and every credential use needs an approved grant. See Credential governance and its runbook.
• Store toolkit secrets in Vault or OpenBao through the secret-store integration. See Secrets.
• Set personal access tokens to expire, and keep expiry notices on.

Tools and network

• Restrict toolkit types per project, and block tools you do not use. See App requests and toolkit types.
• List destructive and outward-facing tools as sensitive, so every call pauses for approval. See Sensitive action authorization.
• Keep the egress guard on. Add private hosts to the allow-list only when a toolkit needs them. See Configuration.
• Seed the worker egress allowlist from Configuration › Worker Egress, then set its mode to allowlist. See Least privilege and trust.
• Create connector requests for the connectors in use, approve them, and set Configuration › Connector Catalogue to approved_only. Turn on the architecture attestation requirement if your review board signs off connectors. See Connector approval.
• For remote agents: configure the agent assertion key, set Configuration › Remote Agents › Outbound Assertions to allowlist and list the remote MCP servers that may receive the run’s user, project, run, mandate and toolkit types under Assertion Audiences (the default off sends nothing; the governed profile always sends), add only the issuers that you trust to Trusted Issuers, and run agents that call or are called by remote agents in the governed profile. See Remote agents.
• Review Admin › Credential inventory, set the stale threshold to your policy, and consider stale_action: revoke once the flagged list is clean.
• Have agent owners act on the Permission trimming report, and connect your IGA tool to the entitlement export.
• Set a maximum idle timeout and session lifetime under Configuration › Session Policy. See Authentication.
• After every worker runs the release, save Configuration › Delegation in enforce mode, with Maximum Delegation Depth at the lowest value your agents need. Saving the section starts data class narrowing. Set data classes on the registry record of each agent that delegates. See Delegation narrowing.
• Set Maximum Run Time under Configuration › Run Caps above your longest legitimate run. After every worker runs the release, set the per-tier tool call, model turn, spend and records read caps, lower for the high and critical tiers, and give safety.override_cap only to the people who may let a run use more. See Run caps.

Runtime safety

• Decide who may stop agents and projects, and who may stop the whole platform. Grant the permissions to those roles only. See Runtime safety.
• Keep the kill-switch self-test enabled, and alert on its last-success metric. See the emergency stop runbook.
• Keep Configuration › Circuit Breaker on. Review the error-rate and tool-failure limits per tier, and set Spend per Hour and Runs per Hour for the tiers of agents that spend money or send messages (they are off by default). Tighten the limits of individual agents on their registry record. See Agent circuit breaker.
• Route the runtime safety alerts (EliteaPlatformExecutionSuspended, EliteaAgentBreakerStorm, EliteaAgentBreakerTripped, EliteaExecutionSuspensionsActive) to your on-call. They need the Prometheus Operator, or a scrape of elitea-main’s port 9464.
• Keep Configuration › Approvals › Unattended Default at fail, so a scheduled or triggered run that needs an approval stops instead of continuing. Set skip or notify_and_wait only on the schedules and triggers that need it. See Approval evidence and unattended runs.
• Create Content guardrail entries under Admin › LLM Governance: a secrets detector with mask on the input and output stages, and the patterns, terms or classifier adapter that your policy needs. Keep fail_mode: closed on entries that block or mask. Store adapter credentials as {{secret.NAME}} and add the adapter host to the egress allowlist. See Guardrail pipeline.
• Set project budgets. A reached budget refuses further model calls. See Budgets and LLM governance.
• After every worker runs the release, review and save Configuration › Approval Policy, so tools in the delete, external_send and payment categories pause for approval at the high and critical tiers. Select high and critical under Tiers That Require a HITL Node in Pipelines. See Tool categories and approval policy.
• Keep Configuration › Approval Policy › Tiers With the Read Untrusted, Then Act Rule at high and critical or more, so an agent that reads a tool result and then deletes, sends or pays asks a person first. See Untrusted content.

Content

• After every worker runs the release, save Configuration › AI Disclosure with the marker text that your legal function approves. Keep Toolkit Types a Project Can Opt Out Of empty unless a contract requires otherwise. See AI disclosure.
• Write the organisation’s rules for every agent in Configuration › Platform Preamble. Keep it short, and keep secrets and personal data out of it. Review the revisions and their config.changed audit events. See Platform preamble.

Change control

• Set each production agent’s risk tier and owners. Agents that existed before the upgrade start at medium. See Agent lifecycle.
• Review the tier policy under Configuration › Agent Lifecycle: approvals, recertification cadence and mandatory attestations. Set Lapse action to suspend if a lapsed certification must stop the agent. See Configure the tier policy.
• Decide who holds models.applications.governance. By default every project admin holds it.
• Mark a release gate suite on every agent at tier high or critical, and a regression suite. See Evaluation gate.
• Give your GRC tool an API token with lifecycle.attestations.write, so review outcomes are recorded as attestations.

Evidence and data

• Configure the audit export to your SIEM, and keep the copy of record in WORM storage. See Audit trail and Audit event schema.
• Set the maximum retention for each data class to match your records schedule. Know how to place a legal hold before you need one. See Audit evidence and retention.
• Alert on audit-export lag and dead letters (the chart ships the rules). The run_steps stream is included.
• Set the step_content and step_record maximums, and set evidence_fields on toolkits whose results carry data you must not keep. See Run step records.
• Grant runs.evidence.read only to the roles allowed to read prompts and tool results, and review the content-read rows in the audit trail.
• Verify a sample of run chains and the admin audit trail chain on a schedule, and compare run anchors with your SIEM copy. See Reconstruct an agent run.

Keep it current

This checklist grows as the controls in the catalogue ship. Re-read it after each upgrade: the “What’s new” page lists every new control and its default.