> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kayanos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Member keys and signatures

> Administer member signing credentials through controlled enrollment, public credential inventory, revocation, and audit review without exposing private signing material.

Member keys support configured formal signing workflows. They are not ordinary profile preferences and are not a replacement for a task status, chat acknowledgment, or a drawn mark on a document. An administrator can manage enrollment and public credential state only through the organization’s approved identity process; the signing member must still satisfy the relevant form, signer-rule, capacity, permission, and record-scope requirements.

For the Directorate of Citizen Services, use keys only where a published decision workflow requires a signature. Keep enrollment, credential review, a signing request, and final service decision as separate accountable steps.

## Goal

Enroll and govern member signing credentials safely, understand time-limited enrollment and signature handoff steps, and respond to loss, transfer, or suspected compromise without exposing secrets.

## What administrators can and cannot do

| Control                     | Administrator responsibility                                                                  | Boundary                                                                           |
| --------------------------- | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Enrollment                  | Create a controlled enrollment for the intended member and confirm identity/process ownership | Do not copy private material or complete a member’s signing step on their behalf   |
| Public credential inventory | Review which public credentials are active/revoked and their associated member state          | A public credential record is not a usable private key                             |
| Revocation                  | Disable a credential that must no longer sign                                                 | Revocation does not rewrite prior signed workflow evidence                         |
| Audit                       | Review recorded administrative/signing events and investigate anomalies                       | Audit review is not permission to inspect unrelated case data                      |
| Signing capacity            | Confirm whether a signer is acting personally or in an eligible position capacity             | Capacity must match the configured signer rule; a role title alone is insufficient |

Use the smallest administrator group that can enroll/revoke. An organization owner or specifically authorized key administrator should approve access; a person who can manage members does not automatically need access to signing enrollment.

## Security terms

| Term                     | Meaning                                                                                                                    |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| Enrollment credential    | A short-lived, controlled step that lets the intended member begin credential setup                                        |
| Public credential        | The organization-visible record used to verify signing capability and status                                               |
| Private signing material | Sensitive material controlled by the signing member/device; never put it in a ticket, chat, email, screenshot, or document |
| Revocation               | The state that prevents the credential from being used for new signing operations                                          |
| Personal capacity        | The member signs as themselves                                                                                             |
| Position capacity        | The member signs through an eligible active position when the signer rule permits it                                       |
| Signature handoff        | A short-lived handoff used by the signing flow; it expires after five minutes                                              |

Enrollment credentials are deliberately short-lived: the current enrollment flow expires after fifteen minutes. Treat an expired enrollment as a normal security result, not as a reason to reuse an old string or weaken identity checks.

## Before enrolling a member

1. Confirm that the service actually uses a published formal signing workflow. A normal task completion does not need a member key.
2. Verify the member’s identity, organization, current assignment, and whether they may sign personally or through an eligible position.
3. Confirm the signer rule, the expected decision/form, and the record scope. Enrollment does not grant the ability to sign every request.
4. Choose an approved device and secure handoff method. Do not use a shared workstation, a citizen-facing device, or an unverified personal messaging channel.
5. Record the approving administrator, purpose, time, and service policy reference. Do not record a private key, PIN, enrollment value, or handoff token.

If the member is transferring, offboarding, or on leave, resolve their signing responsibilities before starting a new enrollment.

## Controlled enrollment workflow

Open **Administration → Member keys and signatures** and use the enrollment controls only with approved authority.

1. Select the intended member carefully. Confirm the member name, organization, and current role/position context before creating anything.
2. Create the enrollment credential. It is valid for fifteen minutes; plan the secure handoff before generating it.
3. Give the member only the approved enrollment path through a secure channel. Do not paste the enrollment value into documentation, a support ticket, a general chat, or a screenshot.
4. The member completes the required credential setup on the approved device. The administrator confirms completion by checking the public credential inventory and audit result, not by asking for private material.
5. Perform a controlled non-production signing test against a published training workflow. Verify that the correct member/capacity is recognized and that the workflow records a result.
6. Close the enrollment record according to your policy and record the evidence of completion without retaining secrets.

If the credential expires before completion, invalidate the attempt through the approved process and begin a new, identity-verified enrollment. Do not repeatedly resend or extend a stale value.

## Signing capacity and formal decisions

A member can have a personal signing capacity and, when they hold active positions, position-based capacities. A signing request can restrict which capacity tokens are acceptable. Before a service decision:

1. Open the controlled form/action that requires the signature.
2. Confirm the member is the authorized signer for the rule and record scope.
3. Confirm the selected personal or position capacity is allowed by the signer rule.
4. Review the request, evidence, status, and decision text before starting the signature handoff.
5. Complete the short-lived handoff promptly. If it expires after five minutes, restart the authorized handoff; do not improvise a bypass.
6. Verify the signed workflow result and record the final service outcome on the request through the approved path.

An available member key does not make every decision valid. The form/action, signer rule, signing capacity, role/scope, and required evidence must all agree.

## Revoke, investigate, and offboard

Revoke a credential promptly when a member leaves the organization, changes out of a signing position, loses a device, reports suspected compromise, or no longer meets a signer rule. Use the credential list/revocation action and then:

1. Confirm the exact credential/member before revoking; do not revoke a similarly named member’s active credential.
2. Record the reason and time in the approved incident/change process.
3. Review the audit view for relevant enrollment, revocation, and signing events.
4. Reassign pending signing work through the published workflow; revocation does not complete, cancel, or alter a pending decision automatically.
5. Test that the revoked credential cannot be used for a new controlled signature. Enroll a replacement only after identity and authorization are confirmed.

Keep audit evidence and case evidence within their approved retention controls. Do not export a credential inventory broadly simply because it is an administrative table.

## Safe validation matrix

| Test                       | Expected result                                                                                        |
| -------------------------- | ------------------------------------------------------------------------------------------------------ |
| New enrollment             | Authorized administrator creates one controlled enrollment; it expires after fifteen minutes if unused |
| Public credential check    | Credential appears in the permitted inventory without exposing private material                        |
| Personal/position choice   | Only a capacity allowed by the signer rule can be used                                                 |
| Expired handoff            | A handoff older than five minutes is rejected and must be restarted                                    |
| Revocation                 | Credential cannot sign new work after revocation; prior recorded evidence remains reviewable           |
| Unauthorized administrator | Cannot enroll/revoke merely because they can view a member record                                      |

## Troubleshooting

| Symptom                          | Check first                                                                             | Safe response                                                                       |
| -------------------------------- | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| Enrollment cannot start          | Key-administration authority, selected member, and organization context                 | Use the authorized key administrator; do not borrow another account                 |
| Enrollment expired               | The fifteen-minute enrollment window and secure handoff timing                          | Verify identity again and create a fresh enrollment                                 |
| Signing action is unavailable    | Published form/action, signer rule, credential status, capacity, role, and record scope | Resolve the missing prerequisite; do not replace it with a task checkbox            |
| Position capacity is not offered | Member’s active positions and the rule’s allowed capacity tokens                        | Update the legitimate position/rule through approved administration, then retest    |
| Handoff expired                  | Five-minute handoff validity                                                            | Restart the approved signature handoff after reviewing the decision again           |
| Credential must be disabled      | Exact credential, member, incident reason, and pending cases                            | Revoke through the credential action, review audit events, and hand off active work |

## Related guides

* Maintain signing staff and their lifecycle in [Manage members](/admin/manage-members).
* Configure formal decision steps in [Form actions, logic, and signatures](/build/form-actions-logic-and-signatures).
* Help a signer manage their own credential view in [Profile, language, and signatures](/work/profile-language-and-signatures).
* Review least-privilege administration in [Roles and scopes](/admin/roles-and-scopes).

![KayanOS member signing credential settings for the Directorate of Citizen Services.](https://kayanos.app/docs-images/en/admin/member-keys-and-signatures.png)