CAST AI Authentication Boundary

Overview

Keep human castctl login, service API keys, enterprise organization targeting, and cluster installation secrets separate. Choose the narrowest identity for one client, region, organization, and lifecycle.

Prerequisites

• The intended client: castctl, REST, Terraform, CI, or another approved integration
• CAST AI organization, role binding, and environment region
• An approved secret manager, rotation owner, and expiration or review date

Instructions

Step 1: Classify the actor

Use Read and Grep to find existing CAST AI environment variables, provider configuration, CI secrets, Helm values, and runbooks. Distinguish a human interactive session from non-interactive automation; do not reuse one credential across both.

Step 2: Select the authentication path