Security boundaries

Non-negotiable boundaries

Boundary	Enforcement
Tenant isolation	organizationId is derived server-side after membership validation on every tenant query
Authorization	Permission, entitlement and policy checks happen before approval and side effects
Secrets	AES-256-GCM envelope encryption, masking and redaction; no secrets in logs, artifacts, snapshots or AI context
AI	Typed allowlisted tools only; the model cannot authorize, approve, change permissions or use unrestricted shell
Provisioning	Pinned allowlisted modules, isolated workspace runners, encrypted artifacts/state and locks
Agent	Outbound polling, signed envelopes, capability-gated typed commands and revocation
Repository writes	Validated patch branch, secret-file/path-traversal/protected-branch guardrails and optional PR
Evidence	Immutable runs, snapshots, policy decisions, approvals and audit events

Risk controls

Risk 0 is read-only. Risk 1 requires confirmation. Risk 2 requires explicit approval. Risk 3 requires an elevated role, typed target identifier, second confirmation, written reason, idempotency guard, fresh policy/risk evaluation and full audit trail. Destroy and production rollback use the highest-risk path.

Stale or unknown evidence cannot authorize execution. A worker verifies the exact plan and approval before the first side effect and must not report success without verification.

Production checklist

• Replace Compose defaults, rotate JWT_SECRET, encryption keys, Redis and database credentials.
• Configure TLS, COOKIE_SECURE=true, strict CORS_ORIGINS and a trusted reverse proxy.
• Store ENCRYPTION_KEYS in a secret manager and plan key-version rotation.
• Restrict platform-admin entitlement and review activation, suspension and reactivation audit records.
• Keep AI provider keys out of source, logs and diagnostic payloads; validate provider model availability.
• Verify webhook HMAC signatures and deduplicate event IDs at consumers.
• Test tenant isolation, demo restrictions, approval denial and credential redaction before enabling live entitlements.