diff --git a/internal/cli/config_registry.go b/internal/cli/config_registry.go
new file mode 100644
index 0000000..9ec2233
--- /dev/null
+++ b/internal/cli/config_registry.go
@@ -0,0 +1,38 @@
+package cli
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+)
+
+// settingDef describes a configurable global setting for `config list`/`set`.
+type settingDef struct {
+	desc     string
+	validate func(string) error
+}
+
+// settingsRegistry is the authoritative set of valid config keys. `config set`
+// rejects keys absent here; `config list` enumerates them.
+var settingsRegistry = map[string]settingDef{
+	"audit_retention_days": {
+		desc: "Days to keep audit-log entries (integer >= 0)",
+		validate: func(v string) error {
+			n, err := strconv.Atoi(v)
+			if err != nil || n < 0 {
+				return fmt.Errorf("must be an integer >= 0, got %q", v)
+			}
+			return nil
+		},
+	},
+}
+
+// settingKeys returns the registry keys in stable sorted order.
+func settingKeys() []string {
+	ks := make([]string, 0, len(settingsRegistry))
+	for k := range settingsRegistry {
+		ks = append(ks, k)
+	}
+	sort.Strings(ks)
+	return ks
+}
diff --git a/internal/cli/config_registry_test.go b/internal/cli/config_registry_test.go
new file mode 100644
index 0000000..1afb679
--- /dev/null
+++ b/internal/cli/config_registry_test.go
@@ -0,0 +1,28 @@
+package cli
+
+import "testing"
+
+func TestSettingsRegistry(t *testing.T) {
+	def, ok := settingsRegistry["audit_retention_days"]
+	if !ok {
+		t.Fatal("audit_retention_days must be registered")
+	}
+	if def.desc == "" {
+		t.Error("registered setting needs a description")
+	}
+	if err := def.validate("30"); err != nil {
+		t.Errorf("validate(30) = %v, want nil", err)
+	}
+	for _, bad := range []string{"-1", "abc", ""} {
+		if def.validate(bad) == nil {
+			t.Errorf("validate(%q) = nil, want error", bad)
+		}
+	}
+	if _, ok := settingsRegistry["nope"]; ok {
+		t.Error("unknown key must not be present")
+	}
+	keys := settingKeys()
+	if len(keys) != len(settingsRegistry) {
+		t.Fatalf("settingKeys len=%d, want %d", len(keys), len(settingsRegistry))
+	}
+}