Knowledge Platform — Security¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Scope and ACL¶
Every chunk, vector, fact, artifact and memory carries the tenant, the project (or tenant-wide marker) and an ACL scope mapped from the source's permissions at ingestion. Retrieval applies scope in the backend filter before top-k (ADR-0013); context assembly considers only candidates in the attempt's scope; artifacts have an access scope beyond the project only when declared. A backend that cannot pre-filter is not enabled.
Classification and redaction¶
Sources declare a classification (public, internal, confidential, restricted); the policy engine validates mappings at registration and decides redaction for included content at assembly and preview time (ConnectSoft.Extensions.Compliance). Restricted content never leaves its region and is never promoted to Shared memory.
Credentials¶
The platform holds no source credentials: sources reference connections (BC-16) and the Secret Broker (BC-40) issues short-lived access per snapshot. Store credentials (knowledge, vector, blob) are brokered from Key Vault through workload identity.
Trust tiers and prompt injection¶
Retrieved content enters context as data labelled with its trust tier and provenance; instructions found in retrieved content are not instructions. Inferred facts and agent observations never outrank source facts, and unverified memory is retrievable only as such. This labelling is the Factory's first guardrail against indirect prompt injection; output validation and tool gating are the second and third.
Memory governance (D32, D33)¶
Learning is tenant-scoped; promotion of semantic memory is an approval-gated action of class publication bound to the memory's content hash; Shared scope needs the tenant's consent record; reviewers are never the run's requester (ADR-0015).
Data lifecycle (D31)¶
Snapshots, indexes, artifacts, context snapshots and memory follow the project's retention (1 year default) and the tenant's region; deletion lineage reaches every derived item within 30 days and writes evidence; export in open formats precedes deletion when chosen; derived indexes are deleted with their sources.
Audit¶
Source registration and deletion, index rebuilds, memory promotions and archivals, consent changes, artifact deletions and exports are consumed by AuditService; retrieval queries are recorded with their scope for 90 days.