Station70 Castle

Castle is a reference architecture and access control product from Station70 that enforces a two-person rule for accessing shared root-level accounts such as AWS root and DNS registrar accounts. Instead of storing root MFA seeds in a password manager accessible to multiple people, Castle enrolls TOTP seeds for critical infrastructure accounts under an approval-based policy. Each policy defines a requestor group, an approver group, an approval threshold, and a time-bound access window. When a requestor needs access, they submit a request with a note, and their device and location details are captured. Approvers receive a push notification containing the requestor's context and must complete a biometric check to approve, with the response cryptographically signed. The requestor's own approval is structurally blocked from counting toward the threshold, enforcing separation of duties at the access-service layer rather than relying on process alone. Upon approval, an enclave generates a scoped, time-limited window of TOTP codes encrypted to the requestor's device. All code displays, requests, approvals, and denials are timestamped and recorded in an audit log accessible through an admin console, providing a record for auditors of who accessed a Tier 0 account, when, and who approved it.