Credential Custody and Sessions Without Password Sharing

Credential custody is the CerberusD model for opening work without handing the target credential to the person doing the work. CerberusD treats human assignment, credential ownership, session preparation, closure, and evidence as separate responsibilities.

A session without password sharing means the target credential can still exist, while the person does not work by viewing, copying, or storing that value.

Scope

Shared-password access makes accountability blurry. Once a password is shown to a person, closing a button in a panel does not prove where that password was copied, how long it remained usable, or whether it was reused somewhere else.

CerberusD reduces that risk by separating the credential flow from the human assignment:

• the person can see an assigned resource without seeing the target password,
• the session decision evaluates identity, resource, assignment, time, and policy,
• credential preparation is used only for an approved work context,
• closure leaves a record of the decision and session lifecycle.

How it works

Credential custody has four parts.

Secret ownership keeps the target password, key, or connection material out of the normal user-facing surface.

Decision binding ties credential use to an explicit assignment and session decision. If identity, role, resource readiness, time, or policy does not fit, credential readiness does not become session access.

Preparation binding evaluates credential readiness with the local or protocol preparation required for the target resource. On Windows resources, the managed local account model can strengthen that binding.

Evidence binding records the access operation without exposing the secret value. The record shows the decision, resource, person, session, closure, and revocation context.

Process

1. A resource is connected and prepared for managed access.
2. Local account or target credential preparation is performed when needed.
3. An authorized role assigns a person to the resource.
4. The person sends a session launch request.
5. CerberusD evaluates identity, resource, assignment, time, readiness, and policy.
6. If the decision is positive, the session gateway works with the approved session context.
7. The person reaches the browser work surface without seeing the target credential.
8. Closure writes the decision, lifecycle, and final state into evidence.

Dynamic password preparation

Some deployments can use local account preparation or dynamic password rotation. This behavior belongs to the credential custody model: the password is not handed to the daily user, and preparation is evaluated with session launch and closure behavior.

For Windows resources, that preparation can use the managed local account model. The agent can create the account or rotate its password through an authorized action; when work ends, disablement or deletion can be tied back to evidence. Read Managed local accounts for the focused flow.

Envelope encryption link

Envelope encryption keeps secret material from spreading as plaintext through the product surface. Credential custody ties that approach to the session decision:

• secret material is not displayed to the person launching work,
• use of the secret is bound to an approved session context,
• copying a static password is not the normal production path,
• the credential event is linked to decision and session evidence.

Records

Credential custody evidence does not display the credential itself. Reviewable data is:

• who launched work,
• which resource was targeted,
• which assignment and role responsibility applied,
• when credential readiness was part of the decision,
• when the session opened and closed,
• whether revocation, disablement, or resource removal followed.

This shifts review away from “who still has the password?” and toward “which person worked on which resource under which decision?”