Zero trust and the risk engine

1Claw assumes no implicit trust. Every request is authenticated, authorized against policy, and audited to a tamper-evident SHA-256 hash chain. Revocation is immediate: delete a policy and access stops on the next request. On top of that, the risk engine scores every authentication event in real time.

• Geo-velocity: impossible travel between two locations
• First-seen: a new ASN, country, or device for this principal
• Honeytokens: decoy secrets whose access records a critical verdict
• DPoP binds a JWT to a client keypair (RFC 9449)

1. 1

   Export your API key and vault ID. Use your vault UUID from 1claw vault list or Foundations.

   bash Copy

   export ONECLAW_API_KEY="1ck_your_key_here"
   export VAULT_ID="your-vault-uuid"

2. 2

   Exchange your API key for a bearer token.

   bash Copy

   export TOKEN=$(curl -s -X POST https://api.1claw.co/v1/auth/api-key-token \
     -H "Content-Type: application/json" \
     -d "{\"api_key\":\"$ONECLAW_API_KEY\"}" | jq -r .access_token)

3. 3

   Create a honeytoken. The honeytoken registers a canary on this path. Any read of this path triggers a critical alert and session revocation. Pick a path that looks valuable so an attacker is tempted.

   bash Copy

   curl -s -X POST https://api.1claw.co/v1/risk/honeytokens \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"vault_id":"'"$VAULT_ID"'","secret_path":"api-keys/production","notes":"Canary for vault breach"}'

4. 4

   Confirm it is armed by listing your honeytokens.

   bash Copy

   curl -s https://api.1claw.co/v1/risk/honeytokens \
     -H "Authorization: Bearer $TOKEN"

5. 5

   Optional: read the honeytoken path and confirm the token is revoked on the next request.

   bash Copy

   curl -s https://api.1claw.co/v1/vaults/$VAULT_ID/secrets/api-keys/production \
     -H "Authorization: Bearer $TOKEN"
   # Now try another request; it should fail with 401
   curl -s https://api.1claw.co/v1/vaults/$VAULT_ID/secrets/api-keys/production \
     -H "Authorization: Bearer $TOKEN"

You now have a live canary: any read of api-keys/production records a critical verdict and revokes that principal's sessions.

Where this goes wrong in practice. Zero trust fails less from bad architecture than from the slow accumulation of individually reasonable exceptions.

• Grants outlive their reason. Access is added for a migration, the migration ends, and nothing removes it. Expiry on the grant is the only mechanism that survives people forgetting.
• Least privilege is applied once, at creation. Scope is set carefully on day one and then only ever widened, because widening unblocks someone and narrowing risks breaking something nobody has time to test.
• Break-glass becomes routine. An emergency path used twice a year is a control; used twice a month it is the normal path with extra logging.
• Blast radius is never actually calculated. Teams assert that a compromise would be contained without enumerating what one credential reaches. The enumeration is usually surprising.