Segregation of duties in the pipeline — the structural control

Segregation of duties is the structural control that prevents one identity from taking a change from idea to production without anyone else’s involvement. The control is structural because it is enforced by the pipeline itself - OIDC tokens, branch protection, signed identities - not by a wiki page. A procedural control is a wiki page; a structural control is a check the pipeline cannot bypass. This lesson defines the four duty pairs and the mechanisms that enforce them.

What segregation prevents

Segregation prevents a single identity from causing and authorising a change, or from authorising and applying it. The risk is not malice; it is that a single identity can be compromised, coerced, or mistaken, and a pipeline without segregation lets that identity take a change through:

flowchart LR
    A["Author"] -->|"commit"| P["PR"]
    P -->|"review"| AP["Approver"]
    AP -->|"merge"| CI["CI"]
    CI -->|"deploy"| D["Deployer"]
    D -->|"apply"| PROD["Production"]
    O["Operator"] -->|"runtime"| PROD
    SED["Segregation"] -.-> A
    SED -.-> AP
    SED -.-> CI
    SED -.-> D
    SED -.-> O

Without segregation, any role can be the same identity. With segregation, the pipeline prevents the same identity from occupying two roles that must be separated.

The four duty pairs

flowchart TB
    P1["1. Author != Approver"] --> M1["Branch protection:\nno self-approve"]
    P2["2. Author != Deployer"] --> M2["Deploy is CI,\nnot author"]
    P3["3. Approver != Deployer"] --> M3["Deployer is CI OIDC,\nnot the approver"]
    P4["4. Deployer != Operator"] --> M4["RBAC: deployer writes,\noperator reads"]

• Author != approver. Branch protection.
• Author != deployer. Deploy runs as CI OIDC.
• Approver != deployer. Separate OIDC identity.
• Deployer != operator. RBAC: write vs read.

The role of OIDC and signed identities

OIDC turns segregation from a wiki page into a pipeline check. The CI runner presents an OIDC token to the cluster API; the cluster validates the token and grants a specific role with specific rights. Rights do not extend to humans holding different tokens.

• The author pushes a signed commit (GPG or SSH).
• The CI runner presents its OIDC token (the token.actions.githubusercontent.com subject); the cluster API grants the deployer role with write-on-create rights only.
• The operator presents their own identity; the cluster API grants the reader role with read and exec but no write rights.

The segregation is the OIDC configuration. An auditor verifies it with kubectl auth can-i.

The segregation test

Run quarterly against a sample pipeline. Identities: human author, human approver, CI runner, human operator. Operations: write to repo, approve PR, trigger deploy, hit cluster API, exec into pod.

flowchart LR
    TEST["Segregation test"] --> I1["Can author approve own PR?"]
    I1 -->|"yes"| FAIL1["FAIL: branch protection misconfigured"]
    I1 -->|"no"| I2["Can author trigger deploy?"]
    I2 -->|"yes (manual)"| FAIL2["FAIL: deploy not CI-only"]
    I2 -->|"no"| I3["Can approver trigger deploy?"]
    I3 -->|"yes (manual)"| FAIL3["FAIL: approver has CI token"]
    I3 -->|"no"| I4["Can deployer exec into pods?"]
    I4 -->|"yes"| FAIL4["FAIL: deployer role too broad"]
    I4 -->|"no"| PASS["PASS: segregation holds"]

A pipeline that fails any check has a segregation gap: either a configuration error (most common) or a design error.

Production discipline

1. Segregation is structural. A wiki page is a hint; the OIDC configuration is the control.
2. Long-lived credentials cannot enforce segregation. PATs, static SA tokens, shared passwords are the absence of segregation.
3. The segregation test is run quarterly. A pipeline that passed last quarter can fail after a config change.
4. The audit posture is queryable. kubectl auth can-i is the test.

Cross-course references

• This course, Part CXV (OperatingModel) named the roles whose segregation this enforces.
• This course, Part LXVII (SupplyChain) covered OIDC and signed identities.
• Terraform for Production Sysadmins - Part IX covers the pattern at the Terraform layer.

Quiz