End-to-End Onboarding Guide

Welcome to TRUSTIVAN. This guide walks you through complete onboarding across both core pillars of the platform:

AppSec (Container Vulnerability Management): Scanning container images without Docker daemons, deterministic policy verdicts, and automated CI/CD release gating.
NHI Security (Non-Human Identity & AI Agent Governance): Discovering machine identities across AWS, GitHub, K8s, Vault, and MCP servers, and enforcing 13 deny-by-default runtime guardrails on AI agents.

Our Philosophy
”Scanning is the commodity. The decision is the product."
"Evidence before claims. Deny by default.”

Architecture Overview

                      +---------------------------------------+
                      |       TRUSTIVAN Unified Platform      |
                      +-------------------+-------------------+
                                          |
            +-----------------------------+-----------------------------+
            |                                                           |
            v                                                           v
+-------------------------------+                       +-------------------------------+
|     AppSec & Container Sec    |                       |    NHI Security & AI Agents   |
+-------------------------------+                       +-------------------------------+
| • Daemonless Trivy Engine     |                       | • 5 Infrastructure Connectors |
| • Private Registry Auth       |                       | • Machine Identity Graph      |
| • 5-State Finding Lifecycle   |                       | • 13 Runtime Deny Rules       |
| • Pure Policy Engine Verdicts |                       | • MCP Tool Server Guardrails  |
| • Signed Webhooks & CI Gating |                       | • Ephemeral Access Grants     |
| • SBOM & VEX Interchange      |                       | • Hash-Chained Audit Trail    |
+-------------------------------+                       +-------------------------------+

Track 1: AppSec Container Onboarding

Step 1: Issue a Scoped Machine API Key

For automated CI/CD pipelines, generate a machine credential with minimal required scopes:

curl -s -X POST https://api.trustivan.com/v1/api-keys \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -d '{
    "name": "ci-pipeline-runner",
    "scopes": ["scans:create", "scans:read", "findings:read", "verdicts:read"],
    "expires_at": "2026-12-31T23:59:59Z"
  }'

Save the returned bearer token (twk_...). Keys are hashed at rest and never shown again.

Step 2: Connect Private Container Registries

TRUSTIVAN pulls remote images directly using standard OCI registry APIs—without requiring root access or host Docker daemon mounts. To authenticate your private registries (Docker Hub, AWS ECR, GitHub Packages, Google Artifact Registry, Azure ACR, or Harbor):

curl -s -X POST https://api.trustivan.com/v1/registry-credentials \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "server": "ghcr.io",
    "username": "robot-account",
    "password": "ghp_PersonalAccessTokenOrDeployToken"
  }'

Step 3: Trigger Your First Container Scan

Submit an image for asynchronous scanning:

curl -s -X POST https://api.trustivan.com/v1/scans \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: build-sha-20260927" \
  -d '{"image": "ghcr.io/acme/auth-service:v2.4.1"}'

Poll GET /api/v1/scans/{id} until status reaches completed. Every vulnerability is recorded with one of five lifecycle states: open, triaged, suppressed, resolved, or reopened.

Step 4: Configure Deterministic Policy Engine Rules

Rather than failing on crude vulnerability counts, TRUSTIVAN evaluates your findings against a deterministic rule engine:

curl -s -X POST https://api.trustivan.com/v1/policies \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Release Policy",
    "rules": [
      {
        "id": "block-critical-kev",
        "action": "BLOCK",
        "condition": "severity == 'CRITICAL' && known_exploited == true"
      },
      {
        "id": "warn-high-unpatched",
        "action": "WARN",
        "condition": "severity == 'HIGH' && fix_available == false"
      }
    ]
  }'

Step 5: Gate CI/CD Pipelines with Policy Verdicts

In GitHub Actions, GitLab CI, or Jenkins, branch your release based on the recorded verdict:

VERDICT=$(curl -s "https://api.trustivan.com/v1/scans/$SCAN_ID/verdict" \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" | jq -r .verdict)

if [ "$VERDICT" = "BLOCK" ]; then
  echo "Release gated: Policy verdict is BLOCK"
  exit 1
fi
echo "Pipeline approved with verdict: $VERDICT"

Track 2: NHI Security & AI Agent Governance Onboarding

Step 1: Connect Your Cloud & Developer Environments

NHI Security connects to your environments using read-only APIs:

AWS IAM: Discover IAM roles, machine users, and access keys via STS AssumeRole with external ID verification.
GitHub: Discover GitHub Apps, deploy keys, and bot installations across repositories.
Kubernetes: Discover ServiceAccounts, cluster role bindings, and pod workloads.
HashiCorp Vault: Discover AppRoles, tokens, and entity aliases.

Connect via the console (Integrations → Connectors → Connect an environment) or through the API:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/connectors \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "aws",
    "name": "Production AWS Account",
    "scope": { "kind": "account", "id": "123456789012" },
    "authMode": "assume_role",
    "roleArn": "arn:aws:iam::123456789012:role/TrustivanAuditRole",
    "credentialsReference": "aws-prod-ref",
    "enabledCapabilities": ["identities", "relationships", "credentials", "permissions"]
  }'

Step 2: Onboard Model Context Protocol (MCP) Tool Servers

curl -s -X POST https://app.trustivan.com/nhi/api/v1/connectors \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "mcp",
    "name": "Enterprise Payment MCP Server",
    "scope": { "kind": "instance", "id": "mcp-payment-srv" },
    "endpoint": "https://mcp.internal.acme.com/sse",
    "settings": {
      "authMode": "bearer",
      "protocolVersion": "2025-06-18"
    },
    "enabledCapabilities": ["tool_discovery", "resource_discovery", "relationship_discovery"]
  }'

Step 3: Explore Machine Identity Graph & Blast Radius

Run synchronization (Synchronize now). Once complete, review:

Discover → Identities: Every machine identity with assigned owners and last-use timestamps.
Discover → Graph: Interactive blast radius visualization showing permissions, accessible resources, and trust relationships.
Assess → Risk: Automated risk scoring identifying stale credentials, over-privileged tokens, and orphaned accounts.

Step 4: Configure the 13 Runtime Deny Interception Rules

TRUSTIVAN mediates agent tool calls outside the LLM context window using 13 deterministic rules:

Mandatory Deny Rules (cannot be bypassed):
1. principal_not_live: Identity is inactive or suspended.
2. principal_quarantined: Identity is under active security quarantine.
3. credential_not_usable: Token is revoked, expired, or tampered.
4. tool_not_entitled: Identity lacks explicit entitlement to invoke this tool.
Tunable Challenge Rules (escalates to human review):
- mutating_action_on_high_impact_resource
- unsupervised_mutating_action
- no_active_grant_for_elevated_action
- source_address_unrecognised
- action_outside_usual_hours

Step 5: Issue Runtime Credentials & Enforce Tool Mediation

Issue a dedicated runtime bearer token for your AI agent runtime:

curl -s -X POST https://app.trustivan.com/nhi/api/v1/runtime/credentials \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "identityId": "agent-sales-copilot-01",
    "lifetimeDays": 30
  }'

Before your agent runtime executes any tool, query the mediation endpoint:

curl -s -X POST https://app.trustivan.com/api/v1/mediation \
  -H "Authorization: Bearer $RUNTIME_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "requestedOperation": "payments.refund.issue",
    "declaredActionClass": "write",
    "toolKey": "mcp.payment.refund",
    "resourceKey": "invoice:inv-94820",
    "intent": "Customer requested refund for duplicate order",
    "requestId": "req-uuid-001"
  }'

The gate immediately returns:

decision: "allow": Tool execution authorized.
decision: "challenge": Requires dual-approval time-bounded access grant.
decision: "deny": Request blocked and recorded in append-only decision log.

Step 6: Verify Cryptographic Audit Trail

Every mediation decision, credential rotation, and grant approval is recorded in an immutable, hash-chained log. Export offline verifiable compliance proofs:

curl -s "https://app.trustivan.com/api/v1/audit/export?format=jsonl" \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" > audit-chain.jsonl

Onboarding Checklist

Step	Action	Status Check
AppSec 1	Issue API key with `scans:create`	`twk_...` saved in CI secret store
AppSec 2	Register private registry credentials	`GET /api/v1/registry-credentials` returns 200
AppSec 3	Run first container image scan	Scan state transitions to `completed`
AppSec 4	Define policy rules and evaluate verdicts	Verdict reports `PASS`, `WARN`, or `BLOCK`
AppSec 5	Wire CI/CD release gate	Pipeline blocks unapproved builds
NHI 1	Connect AWS, GitHub, K8s, or Vault	Connector status reports `healthy`
NHI 2	Connect MCP tool server	Tool inventory populated in Discover → Agent tools
NHI 3	Verify Identity Graph & ownership	Machine identities mapped to human owners
NHI 4	Activate 13 Runtime Deny Rules	Default deny enabled on unentitled actions
NHI 5	Integrate runtime mediation API	Agent tool requests intercepted at `POST /api/v1/mediation`
NHI 6	Test dual-approval access grants	Challenges require second admin approval

Next Steps

Private Registry Scanning: Detailed setup for ECR, GHCR, ACR, and GAR.
Pipeline Gating Tutorial: Production GitHub Actions and GitLab CI workflows.
MCP Server Guardrails: Deep dive into tool sandboxing and parameter guardrails.
Runtime Gate Reference: Full breakdown of all 13 mediation rules.

Getting started

Concepts

Tutorials

How-to guides

Integrations

Help

End-to-End Onboarding Guide

Architecture Overview

Track 1: AppSec Container Onboarding

Step 1: Issue a Scoped Machine API Key

Step 2: Connect Private Container Registries

Step 3: Trigger Your First Container Scan

Step 4: Configure Deterministic Policy Engine Rules

Step 5: Gate CI/CD Pipelines with Policy Verdicts

Track 2: NHI Security & AI Agent Governance Onboarding

Step 1: Connect Your Cloud & Developer Environments

Step 2: Onboard Model Context Protocol (MCP) Tool Servers

Step 3: Explore Machine Identity Graph & Blast Radius

Step 4: Configure the 13 Runtime Deny Interception Rules

Step 5: Issue Runtime Credentials & Enforce Tool Mediation

Step 6: Verify Cryptographic Audit Trail

Onboarding Checklist

Next Steps

​Architecture Overview

​Track 1: AppSec Container Onboarding

​Step 1: Issue a Scoped Machine API Key

​Step 2: Connect Private Container Registries

​Step 3: Trigger Your First Container Scan

​Step 4: Configure Deterministic Policy Engine Rules

​Step 5: Gate CI/CD Pipelines with Policy Verdicts

​Track 2: NHI Security & AI Agent Governance Onboarding

​Step 1: Connect Your Cloud & Developer Environments

​Step 2: Onboard Model Context Protocol (MCP) Tool Servers

​Step 3: Explore Machine Identity Graph & Blast Radius

​Step 4: Configure the 13 Runtime Deny Interception Rules

​Step 5: Issue Runtime Credentials & Enforce Tool Mediation

​Step 6: Verify Cryptographic Audit Trail

​Onboarding Checklist

​Next Steps

Architecture Overview

Track 1: AppSec Container Onboarding

Step 1: Issue a Scoped Machine API Key

Step 2: Connect Private Container Registries

Step 3: Trigger Your First Container Scan

Step 4: Configure Deterministic Policy Engine Rules

Step 5: Gate CI/CD Pipelines with Policy Verdicts

Track 2: NHI Security & AI Agent Governance Onboarding

Step 1: Connect Your Cloud & Developer Environments

Step 2: Onboard Model Context Protocol (MCP) Tool Servers

Step 3: Explore Machine Identity Graph & Blast Radius

Step 4: Configure the 13 Runtime Deny Interception Rules

Step 5: Issue Runtime Credentials & Enforce Tool Mediation

Step 6: Verify Cryptographic Audit Trail

Onboarding Checklist

Next Steps