Binary Authorization

At its core, Binary Authorization mandates that every deployable artifact must carry a valid digital signature from a trusted authority before execution. This process uses asymmetric cryptography where a private key signs the artifact during the build pipeline, and the deployment system verifies the signature using the corresponding public key. The verification confirms two critical properties:

• Integrity: The artifact has not been tampered with since signing
• Authenticity: The artifact originated from an approved build system or authority

This mechanism prevents the deployment of images that have been modified post-build or injected by unauthorized actors, creating a cryptographic chain of custody from build to runtime.

Binary Authorization operates through declarative policy rules that define precisely which attestations and signatures are required for deployment. These policies evaluate attestations—cryptographically signed metadata statements about the artifact's provenance, vulnerability scan results, or build environment. Key policy capabilities include:

• Requiring attestations from specific build systems or CI/CD pipelines
• Mandating that vulnerability scans pass defined severity thresholds
• Enforcing that images originate from approved container registries
• Blocking deployments that lack required attestations entirely

This attestation-based model extends beyond simple signature checks to incorporate rich, verifiable claims about the artifact's security posture and origin.

Production systems require flexibility for incident response, and Binary Authorization supports controlled break-glass mechanisms that allow authorized personnel to bypass policy enforcement during emergencies. These overrides are:

• Fully audited: Every bypass generates an immutable log entry with the operator's identity, timestamp, and justification
• Time-bound: Override permissions can be configured to expire automatically after a defined window
• Role-restricted: Only specific identities or service accounts with elevated privileges can invoke bypasses
• Policy-scoped: Overrides can be limited to specific clusters, namespaces, or artifact patterns

This ensures that security controls do not become obstacles during critical incidents while maintaining complete forensic traceability of all exceptions.

Binary Authorization extends beyond initial deployment to provide continuous runtime verification, detecting configuration drift where running workloads diverge from their attested state. The system monitors for:

• Image mutation: Detection of any modification to a running container image after deployment
• Policy changes: Alerting when deployed artifacts no longer satisfy updated policy requirements
• Signature revocation: Automatic flagging of running workloads whose signing keys have been compromised or revoked
• Attestation expiry: Identification of artifacts whose vulnerability scan attestations have exceeded their validity period

This ongoing validation ensures that the trust established at deploy time is maintained throughout the artifact's operational lifecycle.

Binary Authorization integrates directly into the software delivery pipeline to create a seamless sign-attest-deploy workflow. The typical integration pattern includes:

• Build-time signing: Container images are signed immediately after creation using tools like Cosign from the Sigstore project
• Automated attestation generation: Vulnerability scanners and build systems produce signed attestations as pipeline artifacts
• Pre-deployment validation: Admission controllers query the Binary Authorization policy engine before scheduling pods
• Registry integration: Support for major registries including Artifact Registry, Container Registry, and Harbor

This tight coupling with CI/CD systems ensures that security verification becomes an automated, non-negotiable step in the deployment process rather than a manual gate.

Before enforcing policies in production, Binary Authorization supports dry-run modes that evaluate deployments against policies without blocking them. This capability enables:

• Policy testing: Validating new policy rules against historical deployment patterns to identify false positives
• Compliance auditing: Generating reports on which running workloads would fail current policy requirements
• Gradual rollout: Deploying policies in audit-only mode to measure impact before switching to enforcement
• Continuous compliance monitoring: Tracking policy adherence trends over time across clusters and teams

This observability-first approach allows security teams to refine policies with confidence and demonstrate compliance posture to auditors without disrupting development velocity.