Security and Hardening

The platform-level security controls that protect tenant data, audit integrity, and the deployment pipeline.

This page collects the security posture hardening shipped since v0.12.0, including the tenant isolation and role checks of v0.15.0 to v0.16.1. It complements the confidentiality model (action gating and AI routing) and the audit and SIEM subsystem.

Access policy scoping

Sensitive tables are scoped to the service role so that they cannot be read or written through the standard request-scoped client.

user_feature_flags — feature-flag grants are managed only through server-side, service-role paths
audit_events — audit records are write-only from application code and never exposed to end-user clients

This prevents privilege escalation via direct table access and keeps the audit trail tamper-resistant.

Fail-closed guards

Guards default to denying the operation when preconditions are not met.

Staging seed guard — the staging database seed refuses to run unless an explicit target allowlist is provided and the connection is HTTPS. A misconfigured or unexpected target aborts the seed rather than proceeding.
Complete directive lists only (v0.16.0) — when the directive catalog, a project's rules or its settings cannot be read, the agent file export, pd_list, directive_export and the directives REST endpoint answer 503 with the missing sources instead of returning a list without the platform rules. Agent files are not regenerated from an incomplete list.

Fail-closed means the safe default is to stop. An unset or ambiguous configuration results in denial, not a best-effort attempt.

Tenant isolation (SEC-007)

Database tables must not be readable across tenants through the public data API, even by signed-in users with their own token.

v0.15.0: fourteen tables (including licenses, skill versions, reviews and their comments and participants, workspaces, baselines, flavors, blueprint versions, machines, actors and actor assets) had a permissive read policy for every signed-in user. These policies were dropped; the application reads these tables only through server-side paths, so its behavior did not change.
v0.16.0: eight more tables (tags, entity tags, model routes, runtime and model profiles, provider deployments, route policies and provider subscriptions) followed.
Both migrations fail if a permissive read policy for signed-in, anonymous or public roles remains afterwards, so the gap cannot silently reopen.

Role checks

Area	Since	Rule
Skills via MCP	v0.16.0	Core skills: platform admins only. Project skills: project admin or editor. Assigning and unassigning: project admin or editor (before: any member, including viewers).
Directives via MCP	v0.16.0	Create, update and toggle: project admin or editor. Delete: project admin. Update, delete and toggle write audit entries.
Workspace forks	v0.16.1	Viewing forks needs project membership; creating, editing, activating, syncing, exporting or deleting them needs a project admin or editor role. Platform admins keep access. Before, any signed-in user could reach these routes.

See Workspaces and Skills.

Node calls and DNS rebinding

Since v0.16.0, calls from the control plane to registered AI nodes (compose file, logs and activation) are protected against DNS rebinding. Every address a node hostname resolves to is checked when the connection is made:

loopback, link-local and cloud metadata addresses are refused
public names must resolve to public addresses; LAN names may resolve privately
redirects from a node are no longer followed or passed through; they return 502

Secret scanning

gitleaks pre-commit hook — runs fail-closed. A commit that would introduce a secret is blocked before it can enter history.

This keeps credentials, tokens, and private keys out of the repository at the earliest possible point.

Safe export encoding

CEF output escaping — the SIEM CEF export escapes field values on the server so that event data cannot inject or break out of CEF fields in downstream parsers.

See Audit Log and SIEM for the export endpoints and formats.

The following controls documented elsewhere form part of the same security posture.

Control	Where
Confidentiality action gating	Confidentiality Action Gating
Audit log and SIEM export	Audit Log and SIEM
Feature-flag entitlements	Feature Flags
C&C channel security (Ed25519, AES-256-GCM)	Changelog v0.8.0
Envelope encryption	Changelog v0.6.10