Bounded lifetime
Certificates contain an expiry and are rejected outside their validity window.
Short-lived human sessions
Access expires with the certificate.
For optional human SSO, Safe Boundary issues a client certificate with a bounded lifetime. The proxy rejects expired or revoked certificates and can cancel active sessions by serial number.
Expiring human sessionsUse a short-lived certificate for each session
Expiry enforcedSAML / OIDC LOGIN
Expiring certValidity window active
BOUND TOPROXY mTLS
TTL
Why this exists
What “time-limited” means in the current product
The implemented mechanism is a short-lived, identity-bearing certificate for a human proxy session. It gives operators a concrete session credential to expire and revoke.
This is not a generic just-in-time authorization system. Safe Boundary does not currently advertise approval workflows, arbitrary row or table grants, or temporary per-operation privilege elevation.
What it does
Concrete controls, stated precisely.
Revocable
A serial can be added to the revocation store and refused on subsequent connections.
Cancelable
Active sessions associated with a certificate serial can be force-disconnected.
Session lifecycle
Expiry is one control; revocation and cancellation are the others.
| Decision | Issue | During session | End access |
|---|---|---|---|
| Certificate | Short-lived identity-bearing certificate | Proxy validates CA, purpose, and validity | Expiry rejects later connections |
| Operator response | Record serial and subject | Monitor active session | Revoke serial or cancel matching active session |
How it works
A visible enforcement sequence.
Sign in
Complete SAML or OIDC authentication.
Issue
Create a client certificate with the configured lifetime.
Present
Use the certificate on the PostgreSQL proxy TLS session.
End
Finish access through expiry, revocation, or session cancellation.
Protected when
- ✓SSO-enabled human proxy sessions
- ✓Certificate expiry and serial revocation
- ✓Cancellation of tracked active sessions
Important boundaries
- •Not a generic approval workflow or JIT database grant engine
- •Does not create temporary per-table or per-operation policies
- •Active-session tracking is runtime state, not a distributed authorization ledger
Continue the story
Related Safe Boundary pages
Human SSO →
See the complete SAML/OIDC and mTLS flow.
Security model →
Understand trust boundaries, credentials, identity, and bypass conditions.
Audit and attribution →
Record policy outcomes and the identity information each surface can establish.
Test the boundary on a real access path.
Start in observe mode and validate the policy against representative traffic before you enforce it. That gives the team evidence for each decision, along with explicit bypass controls for the cases that need a deliberate exception.