KMU has operations to store, use, and remove assets.
| Operation | Description |
|---|---|
| Provision | Store assets in SICR |
| Push | Retrieve assets from SICR and push to write-only registers or memory for use |
| Read metadata | Read key slot metadata from SICR |
| Revoke | Remove an asset from SICR |
| Block | Block a keyslot from being pushed, provisioned, or revoked until next reset |
| Push block | Block a key slot by preventing a push until next reset |
KMU allows a single operation to run at a time. Once a TASK is triggered to start an operation, KMU ignores any subsequent TASK requests until the initial operation is complete.