# Machines and sessions

How a person's machine enrolls with a key that never leaves it, how each session gets a short-lived token, and how the kill switch revokes sessions and machines.

In short: A person enrolls a machine once by signing in through the browser, and the Straza service on it makes a key that never leaves it. Each session checks in with a proof from that key and gets a token that lives 300 seconds and renews while it runs. The kill switch revokes sessions, and their next call is denied.


Asessionisonerunofacodingtooloran[agent](https://docs.straza.ai/concepts/identities/index.md#an-agent),andStrazadecideseverycallinitunderashort-livedtoken.Atthetoolboundary,acodingassistantonalaptop,aworkerdeployingfromCIandapersonalagentactingforamanagerlookthesame.Strazatellsthemapartbecauseeachsession'stokennamesitsuser,itsmachine,itscodingtoolandthesessionitself.Decisions,[approvals](https://docs.straza.ai/concepts/approvals-model/index.md)and[auditrecords](https://docs.straza.ai/concepts/evidence/index.md)canthereforebetracedtothenamesinthattoken,andyoucanendasinglesessionormachinewithouttouchingtheperson'sothers.##EnrollingamachineA[person](https://docs.straza.ai/concepts/identities/index.md)enrollseachmachineonce.TheStrazaserviceonthemachinemakesanewEd25519keyandopenstheperson'sbrowseratthesign-inpage:youridentityprovideronenterprise,strazaditselfonstandalone.strazadregistersthemachinewiththatkeyonlywhenthesign-innamesthekeyandisatmost10minutesold.Enrollingalsopinsthekeysthatverifyeachsigned[policy](https://docs.straza.ai/concepts/policy-model/index.md)snapshot,sothemachineusesonlypolicythatstrazadsigned.Amachinewithnobrowsercansigninwithacodeinstead.Acodenamesnokeyandcannotshowwhichmachineitwasapprovedfor,sotheenterpriseprofilerefusesitbydefault.Anenrollmentlastssevendaysfromthesign-inthatmadeit,inbothprofiles.Usingthemachinedoesnotextendit.Afterthat,strazadrefusesthemachine'scheck-insandsayswhy,andthepersonenrollsagainwithanewsign-in.Anadmincanchangethesevendaysinstrazad'sconfiguration.[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md)hasthesteps.##ThemachinekeyThekeyneverleavesthemachine.Theservicekeepstheprivatehalfinitsownstatedirectoryandgivesstrazadonlythepublichalfandproofssignedwithit.Italsobindstheenrollmenttothemachine'sownidentity,soitstopsusingakeywhosefileswerecopiedtoanothermachine.Thecheck-incountercatchesanyotheruseofacopiedkey.Eachcheck-incarriesanumberabovethelastone,andwhenstrazadseesoneatorbelowthelastitaccepted,itrevokesthemachineandrecordsthereuseontheauditchain.Installedfromapackage,theservicerunsunderitsownaccountandkeepsthekeyinafolderonlythataccountcanopen,soaprogramthepersonruns,theiragentincluded,cannotreadit.Bydefaultenterpriserefusesakeykeptintheperson'sownaccount,andstandaloneacceptsboth.Thekeyproveswhichmachineandwhichenrollmentacallcomesfrom.Itisnotproofthatapersonacted,becauseanagentonthatmachinerunsastheperson.Aheldcallthatneedstheperson'sownapprovalgoestoaphoneorbrowsertheyenrolled,as[thesecuritymodel](https://docs.straza.ai/evaluate/security-model/index.md)explains.##AsessionanditstokenWhenacodingtoolstartsasession,thestrazahookaskstheservicetocheckin.Theservicesignsthecheck-inwiththemachinekey,overafreshnoncefromstrazadandthenextcounter,andsendshashesofitsowninstall.strazadcheckstheproofagainstthekeyitregistered,itsin-memorydenylist,theperson'sstatusandtheenrollment'sdeadline.Itthenratestheinstall,resolvestheperson's[roles](https://docs.straza.ai/concepts/roles-and-access/index.md)andmintsasessiontoken.Theratingistheattestationlevel,`none`,`advisory`or`managed`.Managedmeanstheinstall'sfilesmatchthehashesyouregisteredforit.Bydefaulttheenterpriseprofilestartsnosessionbelowmanaged,andthe[gateway](https://docs.straza.ai/concepts/mcp-apps-and-the-gateway/index.md)checksthatminimumagainoneverycall.Thedemostacklowersittononeforalab.Asessionkeepsthelevelitstartedwith,soarenewaldoesnotratetheinstallagain.Thetokennamestheuser,thesession,themachine,thecodingtool,theattestationlevel,ahashoftheroles,thepolicysnapshotandthethumbprintofthemachinekey.Itisvalidonlywithafreshprooffromthatkey,soacopiedtokenaloneisuseless.Itexpiresafter300seconds.strazadchecksitoneverycallwithoutreadingitsdatabase.Theservicerenewsthetokenwhenacallarriveswith120secondsorlessleft.Anidlesession'stokenexpires.strazadclosesasessionafter600secondswithnocheck-inorrenewal,andcloseseverysessionat12hours,renewedornot.Inbothcasesthenextcallstartsanewsessionwiththemachinekeyandnopersonacting,soastolensessiontokenstopsworkingbyaknowntime.Whenthetokenrunsoutandstrazadcannotbereached,theenterpriseprofiletreatsthatunknownstateasadenyandrefuseseverygovernedcallatonce.Astrazadoutagethereforestopsitsagentsforaslongasitlasts.Standalonekeepsdecidingfromitslastsignedpolicyfor15moreminutes.##AnagentwithitsownidentityAnagentwithitsownidentityenrollsnomachine.AworkerinCIhasnolaptop,andnopersonsignsinforit.Theserviceonthemachineitrunsonholdstheagent'skey,oraclientsecretinafileonlytheservicecanopen.TheservicegetstheagentanIDtoken,withthekeyatstrazadorwiththesecretatyouridentityprovider,andreusesituntil30secondsbeforeitexpires.Thenitcheckstheagentinwithafreshprooffromakeyitholdsfortheagent.Everysessionoftheagentisboundtothatkey.[Headlessagents](https://docs.straza.ai/guides/govern-an-agent/headless-agents/index.md)setsoneup.Replacingorremovingtheagent'sregisteredkeyendseveryrunningsessionoftheagentatonce.strazadalsorefusesanIDtokenissuedfortheoldkey,sotheagent'snextsessionneedsthecurrentone.##ThekillswitchDiagram:Disablinganidentityendsitssessionsoneverymachine.AmachinewhoseStrazaserviceholdsthesession'spushstreamlearnsofitatonce.Anyothermachinelearnsofitwhenitnextrenewsthesession'stoken.Youridentitymanagerdisablesapersonoranagent.Strazarevokestheirsessionsandrefusesnewcheck-ins.Connectedclientsgettherevocationasapushanddenyeverycall.Eachstepisrecorded.1.Youridentitymanagerdisablesapersonoranagent.OverSCIMthatisactivesettofalse.2.Strazarevokeseverysessionofthatidentityandrefusesitsnextcheck-ins.3.Connectedclientsgettherevocationasapushoverstrazad'sownaddressanddenyeverycallthatsessionmakes.4.Theidentityisstoppedoneverymachine.Aclientthatmissedthepushisrefusedatitsnextcheck-in.5.Eachstepleavesarecordintheauditchain.Thekillswitchisanyoftheseactions.Eachonereacheseverystrazadreplicaovertheeventbus.-Revokingasessioninterruptsit,andthecodingtool'snextsessionstartopensanewonethateverycheck-inrulejudgesagain.-Disablingorlockingauserendseverysessionofthatuseroneverymachine,andrefusesnewcheck-insuntilsomeoneletstheuserbackin.AdeactivationfromyourIGAoverSCIMdoesthistoo.-Revokingamachineendsitsenrollment,andtheperson'sothermachineskeeptheirs.Atthegateway,strazadrefusesarevokedsession'snextcallatonce,fromitsin-memorydenylist.Onthemachine,theserviceholdsapushstreamforeachsession.Whilethatstreamisopen,therevocationarrivesasapush,andeverycallinthesessiondeniesfromthenon.Theproject'sbudgetforthatpathisundertwosecondsatthe99thpercentile,measuredbytheloadrigin`test/load/probe_kill.go`fromtherevoketotheeventonthesession'sstream.Whenthestreamisdown,thesessionlearnsofitatthefirstcallthatrenewsitstoken,once120ofits300secondsorfewerremain.Forasessionthatkeepsworking,thatisatmostabout180secondsafteritstokenwasminted.Onstandalone,amachinethatcannotreachstrazadatalladdsits15minutesofofflinegrace.Whatstrazaddoesonadeactivation:strazadmarkstheuserdisabled,writesarevocation,addstheusertoitsin-memorydenylist,thenmarkseachoftheuser'ssessionsrevokedandpublishestherevocation.Everyotherstrazadreplicareplaysitintoitsowndenylist.TheStrazaservicereceivesitonthepushstreamofeachsessionitholds.Arenewalthatstrazadrefusesforarevokedusermarksthesessionrevokedinthesameway,andtheserviceneverretriesit.Thedenytheagentreadssaysthesessionwasrevoked,saysthatadisableduser'scheck-inisrefuseduntilanadministratorre-enablesit,andtellstheagenttoinformtheuserandstop.AreactivationfromyourIGAliftsonlytherevocationsyourIGAmade.Alockplacedintheconsolethereforeremains,andtherefusedliftisrecordedontheauditchain.Revokedsessionsstayrevoked,andthemachine'snextcheck-inopensanewsessionwithoutanewenrollment.ASCIMdeactivationalsodeletestheuser'sowncredentialsonMCPservers,theirOAuthgrantsandpastedtokens,soareturninguserconnectsthoseserversagain.AdisablebyaStrazaadminleavesthosecredentialsinplace.Thekillandthelifteachleaveanidentityrecordontheauditchainthatnameswhereitcamefrom,soanauditorcanseewhichauthorityacted.[Lifetimesandtimeouts](https://docs.straza.ai/reference/lifetimes-and-timeouts/index.md#sessions-and-the-client)listseveryboundonthispage.The[kill-switchrunbook](https://docs.straza.ai/guides/operate/kill-switch-runbook/index.md)hasthestepsforeachaction,and[Credentialsandsessions](https://docs.straza.ai/security/credentials-and-sessions/index.md)followsasessionfromstarttoend.Next:[Serversandthegateway](https://docs.straza.ai/concepts/mcp-apps-and-the-gateway/index.md)