CORE / SECSecurity boundary

Security model

Tenant isolation and delegated authorization are enforced across application and database layers. The model is public so operators can review both guarantees and responsibilities.

No valid context, no tenant rows.

  • Missing or invalid signed context yields no tenant-scoped rows.
  • Runtime SQL clients cannot manufacture trusted tenant bindings by setting PostgreSQL GUC values directly.
  • Tenant-scoped data uses forced row-level security.
  • Role history is immutable and grant cycles are rejected.

Separate privileges by job.

Migrations, runtime requests, and maintenance operations use distinct database roles. The maintenance adapter has a separate pool and can export or purge tenant policy data without reading identity or session tables.

Credentials remain server-side.

Administrator passwords use Argon2id. Refresh credentials rotate, remain in HttpOnly SameSite=Strict cookies, and are never returned in JSON. Runtime database credentials and tenant-binding secrets remain high-value operator secrets.

The Console is an administrative interface.

Protect it with HTTPS, restricted administrator accounts, monitoring, backups, and a deliberate exposure policy. The public Demo is a technical preview, not a production SLA or managed service.

Report vulnerabilities privately.

Do not open public issues for suspected vulnerabilities. Follow the repository security policy and include the affected component, reproduction details, and impact.