Marketplace — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| LicenseService |
client-credentials |
factory.marketplace.read factory.marketplace.acquire factory.marketplace.publish factory.marketplace.admin |
row-filter |
spend |
| MarketplaceCatalogService |
client-credentials |
factory.marketplace.read factory.marketplace.publish factory.marketplace.install |
row-filter |
publication |
| MarketplaceHost |
client-credentials |
factory.health.read |
row-filter |
publication |
Principles
- Evidence or nothing. A listing references a Published release with its evaluation record; the marketplace cannot list what Asset Publication did not qualify (ADR-0021).
- Reference, not copy. Installation adds a scoped reference under the installing tenant's policy; the tenant can restrict the asset further and runs pin snapshots as always.
- Public needs certification and approval. Public visibility requires a certified publisher and a Platform admin approval of class publication (D21).
- Spend is a class. Acquisition above the threshold needs an approval of class spend; a project may lower the threshold, never raise it.
- Partner identity is identity. Publishers are organizations in the identity platform; agreements and payout details are references.
- Malicious listings are the threat model. Agents, skills, tools and MCP servers from the marketplace run under the same governance as any asset: policy, side-effect classes, sandboxes, receipts and evaluation (governance §44).
Scopes and roles
| Scope |
Grants |
Roles |
factory.marketplace.read |
browse, search, pricing, own entitlements, reviews |
everyone |
factory.marketplace.install |
install and remove in scope |
Workspace admin, Asset maintainer |
factory.marketplace.acquire |
acquire entitlements |
Workspace admin (spend approval above threshold) |
factory.marketplace.publish |
listings, pricing, publisher application |
Asset maintainer of a publisher |
factory.marketplace.admin |
certification, public listing approvals |
Platform admin |
Threats and controls
| Threat |
Control |
| Malicious skill or MCP server listed |
only Published releases with evaluation evidence; adversarial suites (later); certified publishers; revocation delists and refuses new runs |
| Supply-chain substitution after listing |
listings reference immutable releases by id and hash; a new release is a new listing version with its own evidence |
| Entitlement bypass |
the registry and policy enforce entitlement state at run submission; installations without entitlement fail |
| Fake reviews |
one review per entitled tenant per listing; publisher cannot review own listings |
| Billing abuse |
acquisitions bill the Factory subscription only; spend class; reconciled usage |