> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rubric-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enrollment

> Create, revoke, and renew enrollment tokens.

The Enrollment page is where you mint the long-lived credentials your SDK uses to self-bootstrap.

## Creating a token

Click **Create token** in the top-right. The modal asks for:

* **Name** — a label so you remember what this token is for. Examples: `ci-staging`, `kubernetes-prod`, `mac-laptop-brent`.
* **Max enrollments / hour** — rate limit. Default 60. Set to 0 to soft-disable a token without revoking.
* **Expires in** — number of days. Default 90.

Submit and you'll see a **one-time reveal panel** with the full `enr_<prefix>.<secret>` token plus copy-paste snippets:

```bash theme={null}
export AG_ENROLLMENT_TOKEN=enr_a9f3db48e559.zTYwPTZvvelFZ7IHXICT29jwO14UWUM1IcaAg7Ne7ts
export AG_AGENT_NAME=my-bot
export AG_API_URL=https://api.your-rubric-url.example.com
```

```python theme={null}
from rubric import Governance

with Governance.bootstrap(agent_name="my-bot") as gov:
    ...
```

**The full token is shown exactly once.** Copy it now — the dashboard never reveals it again. If you lose it, revoke and create a successor.

## The list

Each row in the table:

* **Name** — your label.
* **Prefix** — public part of the token (`enr_a9f3db48e559`). Useful when matching log lines.
* **Agents enrolled** — count of agent identities created via this token.
* **Last used** — time of the most recent successful `/enroll` call.
* **Expires** — when the token expires. Reddens in the last 7 days.
* **Status** — `active`, `revoked`, or `expired`.

## Renewing

Click **Renew** on a row. Effects:

* A new token is created with the same `name` and `maxEnrollmentsPerHour`, fresh expiry, fresh secret.
* The old token **stays valid until you revoke it** — so you can rotate without downtime.
* The new full token is shown once in the same reveal panel.

Typical flow:

1. Renew → grab the new token.
2. Roll the env var on your fleet (Kubernetes secret update, Vault rotation, etc.).
3. Verify new agents are enrolling against the new token (the new token's `agents enrolled` counter increments).
4. Revoke the old token.

## Revoking

Click **Revoke** on a row. Effects:

* Marks the token revoked. Future bootstrap attempts with this token are rejected.
* Existing agent identities created via this token **continue to work** — their signed tokens are independent of the enrollment token. You revoke individual identities separately.

To kill both the token *and* every agent it enrolled, use **Bulk revoke** (placeholder in the current build; coming soon).

## Security model recap

Enrollment tokens are **register-only**:

* They cannot ship audit events (those require a signed agent identity, which only the bootstrap flow mints).
* They cannot read bundles.
* They cannot impersonate existing agents — the only thing they can do is create new agent records in your org and get a signed identity for those.

The blast radius if leaked is bounded, auditable (every enrollment is logged with the token id), and revocable per-token. This is by design — see [Identities & enrollment](/concepts/identities) for the full trust model.