Factory Studio — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| StudioBff |
oauth2-jwt |
factory.studio.use factory.health.read |
per-request-claim |
production |
| StudioNotificationService |
oauth2-jwt |
factory.studio.use |
per-request-claim |
shared-write |
| StudioRealtimeGateway |
oauth2-jwt |
factory.studio.use factory.health.read |
per-request-claim |
read |
Principles
- The user's token, every hop. The BFF forwards commands and reads with the user's token (exchanged for downstream audiences through the identity platform); it has no service identity that can act as a user.
- Switchers grant nothing. Scope changes are validated against the identity platform and the Control plane; the permissions snapshot is re-taken; the session's scope bounds every read and every realtime subscription (ADR-0015).
- Gates belong to the owner. Side-effect classes, approvals and separation of duties are enforced by the owning platform; the BFF renders their outcome and never retries, queues or elevates.
- Notifications are permission-checked. Recipients are resolved through the owning platform's check; a notification carries a reference and a summary, and opening it re-checks.
- Content is content. Model outputs, artifacts, logs and knowledge are rendered as untrusted content: sanitized, never executed, never interpreted as instructions by the Studio (prompt-injection posture of the technology radar).
- Secrets never render. The Studio shows references and rotation state, never values; export bundles are delivered as artifacts under permissions.
Scopes and roles
| Scope |
Grants |
Roles |
factory.studio.use |
use the Studio under the user's own grants |
every role; what a user sees and may do comes from the owning platforms per screen |
factory.health.read |
probes |
operators and gateways |
Threats and controls
| Threat |
Control |
| Token theft from the browser |
PKCE, short-lived tokens, refresh in HTTP-only cookies through the edge gateway, revocation on sign-out |
| Cross-tenant read through a crafted scope |
scope validated server-side; per-request tenant claim; the owning platform filters again |
| Prompt injection through rendered content |
content sanitized and sandboxed in the UI; no Studio action is triggered by content; agents never read the Studio |
| Stale permission in an open session |
permission snapshot re-taken on scope change and expiry; commands re-checked by the owner |
| Realtime leak across sessions |
subscriptions bound to session scope; backplane messages carry tenant and session ids; filters narrow only |