DevOps / GitOps — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| DeliveryHost |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
production |
| EnvironmentPromotionService |
client-credentials |
factory.delivery.read factory.delivery.promote factory.delivery.operate |
row-filter |
production |
| PipelineExecutionService |
client-credentials |
factory.delivery.read factory.delivery.propose factory.delivery.operate |
row-filter |
shared-write |
| ReleaseService |
client-credentials |
factory.delivery.read factory.delivery.release |
row-filter |
shared-write |
Principles
- Agents deliver only through tools.
propose-change-set (shared-write) and deploy-environment (production) carry a tool receipt, the policy decision and, where required, the approval; there is no other path from an attempt to a repository or an environment.
- Credentials live in connectors. The Factory holds no personal access token or deploy key of its own; connections (BC-16) hold references, the secret broker issues short-lived credentials, and every call is attributed to the tenant's connection.
- Provenance is mandatory. Commit trailers (run, change set, agent release), pipeline run references and generating asset releases are required for a release; a release without provenance is refused.
- No silent merge. Merges happen in the system of record under its branch policies; the Factory records an approval of class shared-write when it is allowed to merge at all.
- Production needs a person who is not the requester. The production-class approval binds the exact release and environment; it expires; the decider cannot be the requester or the agent's maintainer (D21, ADR-0015).
- Supply chain evidence. SBOM and provenance attestations per release; publication evidence per component from registry reads, not from the pipeline's own claim.
Scopes and roles
| Scope |
Grants |
Roles |
factory.delivery.read |
proposals, runs, releases, promotions |
Requester, Reviewer, Operator, Workspace admin, Observer |
factory.delivery.propose |
open proposals |
the propose-change-set tool under its receipt |
factory.delivery.release |
create and withdraw releases |
Operator, Workspace admin, the release workflow |
factory.delivery.promote |
request promotions |
the deploy-environment tool, Operator, Workspace admin |
factory.delivery.operate |
reconcile, roll back |
Operator |
Threats and controls
| Threat |
Control |
| Agent pushes to a protected branch |
branch policies in the system of record; the tool's class; merge requires a recorded approval |
| Malicious dependency enters a release |
security scan and SBOM as typed results; a failing scan is a failed gate; re-scans of Released components (later) |
| Promotion to production without review |
production-class approval with separation of duties; expiry; policy may add quorum |
| Spoofed webhook marks a run succeeded |
the webhook gateway verifies signatures, replay and deduplication (GW-06); unverified deliveries never reach this platform; reconciliation reads the system of record |
| Tampered release |
immutable release record; digests verified against the registry; attestations referenced; withdrawal blocks promotion |