Member keys and signatures - KayanOS Documentation

Member keys support configured formal signing workflows. They are not ordinary profile preferences and are not a replacement for a task status, chat acknowledgment, or a drawn mark on a document. An administrator can manage enrollment and public credential state only through the organization’s approved identity process; the signing member must still satisfy the relevant form, signer-rule, capacity, permission, and record-scope requirements. For the Directorate of Citizen Services, use keys only where a published decision workflow requires a signature. Keep enrollment, credential review, a signing request, and final service decision as separate accountable steps.

Goal

Enroll and govern member signing credentials safely, understand time-limited enrollment and signature handoff steps, and respond to loss, transfer, or suspected compromise without exposing secrets.

What administrators can and cannot do

Control	Administrator responsibility	Boundary
Enrollment	Create a controlled enrollment for the intended member and confirm identity/process ownership	Do not copy private material or complete a member’s signing step on their behalf
Public credential inventory	Review which public credentials are active/revoked and their associated member state	A public credential record is not a usable private key
Revocation	Disable a credential that must no longer sign	Revocation does not rewrite prior signed workflow evidence
Audit	Review recorded administrative/signing events and investigate anomalies	Audit review is not permission to inspect unrelated case data
Signing capacity	Confirm whether a signer is acting personally or in an eligible position capacity	Capacity must match the configured signer rule; a role title alone is insufficient

Use the smallest administrator group that can enroll/revoke. An organization owner or specifically authorized key administrator should approve access; a person who can manage members does not automatically need access to signing enrollment.

Security terms

Term	Meaning
Enrollment credential	A short-lived, controlled step that lets the intended member begin credential setup
Public credential	The organization-visible record used to verify signing capability and status
Private signing material	Sensitive material controlled by the signing member/device; never put it in a ticket, chat, email, screenshot, or document
Revocation	The state that prevents the credential from being used for new signing operations
Personal capacity	The member signs as themselves
Position capacity	The member signs through an eligible active position when the signer rule permits it
Signature handoff	A short-lived handoff used by the signing flow; it expires after five minutes

Enrollment credentials are deliberately short-lived: the current enrollment flow expires after fifteen minutes. Treat an expired enrollment as a normal security result, not as a reason to reuse an old string or weaken identity checks.

Before enrolling a member

Confirm that the service actually uses a published formal signing workflow. A normal task completion does not need a member key.
Verify the member’s identity, organization, current assignment, and whether they may sign personally or through an eligible position.
Confirm the signer rule, the expected decision/form, and the record scope. Enrollment does not grant the ability to sign every request.
Choose an approved device and secure handoff method. Do not use a shared workstation, a citizen-facing device, or an unverified personal messaging channel.
Record the approving administrator, purpose, time, and service policy reference. Do not record a private key, PIN, enrollment value, or handoff token.

If the member is transferring, offboarding, or on leave, resolve their signing responsibilities before starting a new enrollment.

Controlled enrollment workflow

Open Administration → Member keys and signatures and use the enrollment controls only with approved authority.

Select the intended member carefully. Confirm the member name, organization, and current role/position context before creating anything.
Create the enrollment credential. It is valid for fifteen minutes; plan the secure handoff before generating it.
Give the member only the approved enrollment path through a secure channel. Do not paste the enrollment value into documentation, a support ticket, a general chat, or a screenshot.
The member completes the required credential setup on the approved device. The administrator confirms completion by checking the public credential inventory and audit result, not by asking for private material.
Perform a controlled non-production signing test against a published training workflow. Verify that the correct member/capacity is recognized and that the workflow records a result.
Close the enrollment record according to your policy and record the evidence of completion without retaining secrets.

If the credential expires before completion, invalidate the attempt through the approved process and begin a new, identity-verified enrollment. Do not repeatedly resend or extend a stale value.

Signing capacity and formal decisions

A member can have a personal signing capacity and, when they hold active positions, position-based capacities. A signing request can restrict which capacity tokens are acceptable. Before a service decision:

Open the controlled form/action that requires the signature.
Confirm the member is the authorized signer for the rule and record scope.
Confirm the selected personal or position capacity is allowed by the signer rule.
Review the request, evidence, status, and decision text before starting the signature handoff.
Complete the short-lived handoff promptly. If it expires after five minutes, restart the authorized handoff; do not improvise a bypass.
Verify the signed workflow result and record the final service outcome on the request through the approved path.

An available member key does not make every decision valid. The form/action, signer rule, signing capacity, role/scope, and required evidence must all agree.

Revoke, investigate, and offboard

Revoke a credential promptly when a member leaves the organization, changes out of a signing position, loses a device, reports suspected compromise, or no longer meets a signer rule. Use the credential list/revocation action and then:

Confirm the exact credential/member before revoking; do not revoke a similarly named member’s active credential.
Record the reason and time in the approved incident/change process.
Review the audit view for relevant enrollment, revocation, and signing events.
Reassign pending signing work through the published workflow; revocation does not complete, cancel, or alter a pending decision automatically.
Test that the revoked credential cannot be used for a new controlled signature. Enroll a replacement only after identity and authorization are confirmed.

Keep audit evidence and case evidence within their approved retention controls. Do not export a credential inventory broadly simply because it is an administrative table.

Safe validation matrix

Test	Expected result
New enrollment	Authorized administrator creates one controlled enrollment; it expires after fifteen minutes if unused
Public credential check	Credential appears in the permitted inventory without exposing private material
Personal/position choice	Only a capacity allowed by the signer rule can be used
Expired handoff	A handoff older than five minutes is rejected and must be restarted
Revocation	Credential cannot sign new work after revocation; prior recorded evidence remains reviewable
Unauthorized administrator	Cannot enroll/revoke merely because they can view a member record

Troubleshooting

Symptom	Check first	Safe response
Enrollment cannot start	Key-administration authority, selected member, and organization context	Use the authorized key administrator; do not borrow another account
Enrollment expired	The fifteen-minute enrollment window and secure handoff timing	Verify identity again and create a fresh enrollment
Signing action is unavailable	Published form/action, signer rule, credential status, capacity, role, and record scope	Resolve the missing prerequisite; do not replace it with a task checkbox
Position capacity is not offered	Member’s active positions and the rule’s allowed capacity tokens	Update the legitimate position/rule through approved administration, then retest
Handoff expired	Five-minute handoff validity	Restart the approved signature handoff after reviewing the decision again
Credential must be disabled	Exact credential, member, incident reason, and pending cases	Revoke through the credential action, review audit events, and hand off active work

Maintain signing staff and their lifecycle in Manage members.
Configure formal decision steps in Form actions, logic, and signatures.
Help a signer manage their own credential view in Profile, language, and signatures.
Review least-privilege administration in Roles and scopes.

KayanOS member signing credential settings for the Directorate of Citizen Services.

​Goal

​What administrators can and cannot do

​Security terms

​Before enrolling a member

​Controlled enrollment workflow

​Signing capacity and formal decisions

​Revoke, investigate, and offboard

​Safe validation matrix

​Troubleshooting

​Related guides