Product Fleet Operations — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| FleetIncidentService |
client-credentials |
factory.fleet.read factory.fleet.operate factory.fleet.admin |
row-filter |
production |
| FleetInventoryService |
client-credentials |
factory.fleet.read factory.fleet.admin |
row-filter |
shared-write |
| FleetOperationsHost |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
production |
| FleetRolloutService |
client-credentials |
factory.fleet.read factory.fleet.operate |
row-filter |
production |
Principles
- Operate, never read. The platform holds inventory, rollouts, incidents and off-boardings; it never reads a product's business data. Health comes through the product gateway (GW-07) and the HealthChecks aggregator; data leaves a product only as an export order the customer acknowledges.
- Customer tenants stay inside the product. A customer tenant id is an opaque key here; identity and authorization for customers live in the product (canonical ADR-0100/0101 through the SaaS templates).
- Rollouts cannot bypass gates. A wave is promotions with the same gates; production waves need a production-class approval decided by someone other than the requesting Operator (D21, ADR-0015); ManagedPlus customers opt in to early waves.
- Incidents change nothing. Mitigation is a rollout or a promotion with its own gates; an incident records and communicates.
- Off-boarding deletes last. Export first, handover acknowledged (or a recorded written waiver), then deletion within the window; a whole-product off-boarding is production class.
- Paging and notifications through connectors. Credentials in connections; external class; receipts per message.
Scopes and roles
| Scope |
Grants |
Roles |
factory.fleet.read |
fleet, rollouts, incidents, on-call, off-boardings |
Operator, Workspace admin (own products), Platform admin, Observer |
factory.fleet.operate |
rollouts (plan, resume, roll back), incidents |
Operator; production waves approved by a Reviewer |
factory.fleet.admin |
onboard, objectives, on-call, off-boarding |
Workspace admin of the owner, Platform admin |
Threats and controls
| Threat |
Control |
| Rollout pushes a bad release fleet-wide |
waves with bake and guards; halt and roll back on breach; ManagedPlus opt-in; approval per production rollout |
| Operator reads customer data during an incident |
no data path exists in this platform; product admin APIs behind GW-07 under the product's own authorization |
| Off-boarding deletes before handover |
saga order enforced; deletion needs the acknowledgement or a recorded waiver; evidence |
| Paging spoofed or suppressed |
paging through certified connectors with receipts; coverage-gap alerts; escalation on missed acknowledgement |