Pre-release · Creator
Limen
A unified, identity-aware access layer for infrastructure. Self-hosted, short-lived credentials, auditable.
We live in an era where, now more than ever, we need accountability for every operation performed on infrastructure, in an auditable and reliable way.
We’re increasingly seeing scenarios where humans, AI agents, cloud sessions, and automated bots running through CI/CD pipelines continuously interact with and make changes to the infrastructure that powers our business logic.
Yet a gap remains: the lack of a unified access control model that provides consistent identity management, access control, and auditability across infrastructure.
This is the problem I’m working to solve with Limen.
The vision
A unified access control layer that can:
- Abstract human and machine identities from the underlying infrastructure, removing the need to manage users and credentials individually across different infrastructure components.
- Audit operations across infrastructure components (orchestrators, databases, message queues, and more), so it’s possible to tell which user, bot or AI agent executed an operation and what they did.
- Centralize infrastructure access through a unified portal, with one consistent way to manage and control access across different systems.
- Integrate with identity providers (IdPs) such as Okta and OneLogin, synchronizing organizational users and groups to centralize identity and access management.
Limen is a unified, identity-aware access layer that brings infrastructure access and accountability together.
How it works
People and CI jobs sign in through your identity provider. Limen checks a policy kept in Git and issues a certificate that expires in an hour or less. They keep using ssh, psql and kubectl, and every session is recorded or audited into a signed, hash-chained trail that can be verified independently.
It is three Rust programs: a control plane (identity, policy, certificates, audit), a proxy (the single public entry point) and workers that run inside your network, dial out, and hold the real target credentials so people never see them.
Supported targets today: SSH, PostgreSQL, MySQL, Redis, MongoDB, Elasticsearch and OpenSearch, Kafka, RabbitMQ, Kubernetes, internal web apps and plain TCP.
Status
Open source (Apache-2.0), pre-release and under active development. It is tested against local stand-ins (Dex, containerized databases, a local S3), not yet against real AWS, Okta or Datadog, and it has not had a penetration test. It’s something to evaluate, not to put in front of production yet. The documentation site and the repository’s milestones cover the details and the roadmap.