Product Change Requests¶
Product Change Requests provide a controlled way to modify operations, delete products, or restore products. All changes require approval before they take effect.
Why Change Requests?¶
Products define critical signing and PKI operations. Direct modifications could disrupt active workflows. The change request system ensures:
- Changes are reviewed and approved before being applied
- An audit trail of all modifications is maintained
- Protection against accidental or unauthorized changes
Change Types¶
Modify Operation¶
Allows modifying the settings of an existing product operation. When creating a modify request:
- Select the target product
- Select the operation to modify
- Update the desired settings (approval rules, security groups, etc.)
- Submit for approval
Note
Only products in an active state are available for operation modification.
Set Product To Be Deleted¶
Marks a product for deletion by changing its state to To Be Deleted.
- Products in Ready, InProcess, Rejected, or Failed state can be selected
- The product is not immediately deleted — it is marked for deletion
- A separate delete action can permanently remove products in To Be Deleted state
Warning
Deleting a product is irreversible. Ensure the product is no longer needed before proceeding.
Set Product To Ready¶
Restores a product to Ready state from To Be Deleted state.
- Only products currently in To Be Deleted state are shown
- This effectively cancels a pending deletion
Products & Operations¶
A product represents a signing or PKI use case in the LAAVAT Platform. Examples include:
- Secure Boot — HAB/AHAB signing for NXP processors
- Device Certificates — Issuing unique certificates per device
- Code Signing — OCI, Windows, Java, or RAUC signing
- Encryption — AES key provisioning and image encryption
Each product contains one or more operations that define the cryptographic actions performed. Operations include settings such as:
- Operation type (e.g., SIGN_HAB, ISSUE_DEVICE_CERTIFICATE, SIGN_OCI)
- Approval rules
- Security group assignments
- Token/key configuration
For detailed product configuration, see the Product Guide.
Approval Rules¶
Each operation has approval rules that control access and authorization:
| Group Type | Description |
|---|---|
| Allowed Groups | Users who can submit requests for this operation |
| Approval Groups | Users who must approve requests before they are executed |
| Blanket Groups | Users with pre-approved access — their requests are executed without additional approval |
Tip
When modifying an operation via a change request, you can update the security group assignments to change who has access to the operation.
Product States¶
Products move through a lifecycle of states:
| State | Description |
|---|---|
| New | Just created, pending initial approval |
| InProcess | Approval is in progress |
| Ready | Active and usable for signing/PKI operations |
| Rejected | Approval was rejected |
| Failed | An error occurred during processing |
| To Be Deleted | Marked for deletion via a change request |
| Deleted | Permanently removed from the system |
Deleting a Product¶
Permanent deletion of a product is a two-step process:
- Mark for deletion: Create a change request with type "Set Product To Be Deleted". This moves the product to the To Be Deleted state after approval.
- Delete permanently: From the products list, use the actions menu on a product in To Be Deleted state and select "Delete Product". Confirm the deletion in the dialog.
Warning
Deletion is irreversible. All associated keys and configuration will be permanently removed. Ensure the product is no longer needed and that no active devices depend on it.
Approval Flow¶
- Create — User creates a change request and submits it for approval
- Review — An approver reviews the requested changes
- Approve/Reject — The approver can approve or reject the request
- Applied — Approved changes are automatically applied
Fields¶
| Field | Description |
|---|---|
| Name | A descriptive name for the change request |
| Description | Optional details about why the change is needed |
| Change Type | The type of change (Modify Operation, Set to Be Deleted, Set to Ready) |
| Product | The target product |
| Operation | The target operation (only for Modify Operation type) |
For the full product documentation, see the Product Guide.