Problem Statement
When a security incident occurs, customers need to immediately stop all encryption and decryption operations for a specific namespace or their entire account. Today there is no single customer-facing action to do this — the customer must navigate the key hierarchy manually and operate each level separately.
Business Context
The kill switch is the core sovereignty guarantee of OpenKCM. Regulated industries (banking, healthcare, public sector) require a cryptographic kill switch as a procurement prerequisite. Without it, OpenKCM cannot be positioned as a data sovereignty product.
The soft kill switch (suspend) must cascade top-down from any key level. The hard kill switch (destroy) must be available but gated by multi-party approval — the approval process is the safety mechanism, not hiding the feature.
Scope
In scope:
- Cascade suspend from L2 (namespace level) and L1 (account level)
- Hard destroy gated by M-of-N quorum approval
- NIST SP 800-57 state transitions enforced: active → suspended → deactivated → destroyed
Out of scope:
- Customer UI (owned by CMK)
- Blast radius dry run (separate initiative)
- Recovery flow from suspended state (separate initiative)
Acceptance Criteria
- Suspending an L2 key cascades to all L3 and L4 keys beneath it — all new encryption operations blocked, existing decryption continues
- Hard destroy of a key requires M-of-N quorum approval before execution — the initiator cannot be the approver
- State transitions follow NIST SP 800-57: active → suspended → deactivated → destroyed
- All state transitions are recorded in the audit trail with actor identity and timestamp
- Cascade suspension is atomic — no partial states where some children are suspended and others are not
Success Metrics
- A namespace-level suspend operation completes and cascades to all descendant keys within 1 second
- Hard destroy blocked without quorum approval — zero exceptions
- All state transitions appear in audit trail within 5 seconds of execution
Problem Statement
When a security incident occurs, customers need to immediately stop all encryption and decryption operations for a specific namespace or their entire account. Today there is no single customer-facing action to do this — the customer must navigate the key hierarchy manually and operate each level separately.
Business Context
The kill switch is the core sovereignty guarantee of OpenKCM. Regulated industries (banking, healthcare, public sector) require a cryptographic kill switch as a procurement prerequisite. Without it, OpenKCM cannot be positioned as a data sovereignty product.
The soft kill switch (suspend) must cascade top-down from any key level. The hard kill switch (destroy) must be available but gated by multi-party approval — the approval process is the safety mechanism, not hiding the feature.
Scope
In scope:
Out of scope:
Acceptance Criteria
Success Metrics