Security Model
Security Model
Section titled “Security Model”V1 secures one governed path for approved MCP servers and selected API-backed tools. The model is deterministic: authenticate actor context, hide unauthorized discovery, evaluate Cedar policy, resolve brokered credentials, route only approved backends, manage sessions, and emit metadata-only audit.
Audience
Section titled “Audience”- Security reviewers checking whether V1 covers their required controls.
- Platform owners preparing production hardening evidence.
- Docs authors deciding whether a public claim is safe to publish.
What is this?
Section titled “What is this?”This page summarizes the current V1 security posture. It is not a promise of full DLP, ML prompt-injection detection, endpoint command sandboxing, managed MCP hosting, SCIM/device posture, local STDIO governance outside approved adapter profiles, or tamper-evident audit hash chains.
When do I use it?
Section titled “When do I use it?”Use this page during security review, release-candidate hardening, public docs review, or pilot scoping.
What happens?
Section titled “What happens?”Required V1 controls:
| Surface | Control |
|---|---|
| Identity | Production access cannot be anonymous. OIDC/JWT, SAML-through-proxy, workload identity, or local identity mode must produce normalized actor context. |
| Authorization | Cedar policy preserves default deny and explicit deny overrides allow. |
| Discovery | Unauthorized tools are hidden before execution. |
| Source approval | MCP servers, API sources, tools, agents, client surfaces, credentials, and connectors start unapproved or denied until explicit approval. |
| API adapter | Only selected and approved operations can map to tools. Host, schema, method/path, credential, timeout, and size checks run before upstream. |
| Credentials | Brokered credentials return opaque refs or handles, not secret material. |
| Private routing | Registered private routes and connectors carry health, disable, and revoke behavior. |
| Sessions | Session metadata supports affinity, reconnect where supported, drain, terminate, revoke, and audit. |
| Audit/export | Retained records are metadata-only and customer-controlled for export. |
| Deployment | Managed runs inside the DAC boundary; self-hosted uses customer-managed stores and telemetry/export refs. |
What can go wrong?
Section titled “What can go wrong?”- A new source is approved without owner, risk, credential mode, policy, route, or audit posture.
- A policy change ships without simulation or versioned audit.
- A disabled connector or revoked credential still allows new upstream calls.
- A diagnostic exposes raw endpoint details, request bodies, response bodies, prompts, tokens, or secret refs.
- A public doc links raw reviewer material or partner-only content.
- A deferred capability is documented as current V1 behavior.
Public docs rule
Section titled “Public docs rule”Public docs may include resource IDs, owner IDs, policy versions, credential modes, status codes, safe reason codes, hashes, validation state, and redaction status.
Public docs must not include secrets, credentials, raw tokens, prompts, tool payloads, request bodies, response bodies, customer data, private partner material, raw evidence files, or implementation workpads.
Source truth
Section titled “Source truth”- Read Identity, Policy, Credentials for access checks.
- Read Audit And Deny Diagnostics for investigation rules.
- Read Security Review for control-by-control review.
- Read Managed And Self-Hosted for deployment posture.
Type set in Geist, Source Serif 4, and Departure Mono.