Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| DataEventFoundations |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
production |
| EnvelopeRegistryService |
client-credentials |
factory.data.read factory.data.admin |
row-filter |
production |
| StoreProfileService |
client-credentials |
factory.data.read factory.data.admin |
row-filter |
production |
| RetentionResidencyService |
client-credentials |
factory.data.read factory.data.admin factory.data.acknowledge |
row-filter |
production |
Principles
- The envelope carries trusted identity, not authority.
tenantId and projectId in the envelope are set by the producer from its execution scope and verified by the inbox against the consumer's scope; a trace id is diagnostic and never an idempotency key or an authorization (ADR-0014).
- Registry writes are release actions. Topics, schema versions, envelope profiles and store profiles change through the release pipeline or a Platform admin with the production class; services read.
- Keys and connections are references.
StoreProfileService holds references into the secret broker; no connection string or key is ever in a binding, a manifest or an event.
- Deletion is production-class. A tenant or project deletion needs an approval bound to the exact order; every owner's acknowledgement is a receipt; audit evidence is redacted, never purged (D31, ADR-0015).
- Residency is enforced twice. At store binding (no data lands outside the tenant's region) and at model-deployment and connector selection through
EvaluateResidency, which feeds the model router's privacy class.
- Tenants shorten, never lengthen. Retention overrides tighten the platform ceiling only (D18 tightening semantics applied to data).
Scopes and roles
| Scope |
Grants |
Roles |
factory.data.read |
registry, stores, rules, orders |
Platform admin, Operator, Observer, Workspace admin (own tenant) |
factory.data.admin |
registry writes (platform), retention and residency (tenant), orders |
Platform admin; Workspace admin for the tenant's rules and orders |
factory.data.acknowledge |
owning services acknowledge order tasks |
workload identities of owning hosts only |
factory.health.read, factory.meta.read |
probes and profile metadata |
operators and gateways |
Threats and controls
| Threat |
Control |
| Spoofed tenant in an envelope |
inbox verifies envelope identity against the consumer's scope; mismatches are rejected and audited |
| Poisoned schema (breaking change slipped in) |
compatibility check; breaking versions wait for consumer acknowledgements; model sync reports drift |
| Data landing in the wrong region |
residency check at binding; reconciliation every six hours; binding refused with the rule id |
| Deletion that misses derived copies |
order fan-out includes vector, graph, cache and projection owners; completion only on every receipt; Overdue alerts |
| Export as an exfiltration path |
export is an order with approval for restricted classifications; bundle manifest audited; delivered as an artifact under the tenant's permissions |