Governance — Security¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Fail closed¶
No caller proceeds without a decision; no credential issues without a decision; the host runs three replicas across zones and callers cache only already-issued tokens until expiry. Availability of Governance is availability of the Factory.
Separation of duties (ADR-0015, D18)¶
Approval rules always exclude the requester; publication rules exclude the author; project rules only tighten; Platform admin break-glass needs the rule's allowance and a reason and is always evidence. Platform admins change policy through the release process (Published bundles), never by editing live rules.
Evidence integrity¶
Hash chain per tenant, immutable mirror, daily signed heads, scheduled verification, Critical finding on a break; evidence never holds content or secrets; redaction after retention keeps the chain verifiable.
Secret custody¶
References only; values in memory for the duration of an issuance; delivered once over authenticated gRPC; TTL bounded; revoked with the lease; the broker's own vault access is a workload identity rotated monthly.
AI-specific threats (original handoff §44) and controls¶
| Threat | Control |
|---|---|
| Prompt injection, indirect injection | trust tiers on content, tool results as data, policy decides tools, not prompts |
| Tool injection, unsafe generated commands | descriptors with classes, allow- and block-lists, sandboxes, approvals |
| Data exfiltration | egress allow-lists, external class approvals, redaction, classification routing |
| Malicious MCP servers and skills | registry with authentication, bindings approved per schema, publication gates with evaluation |
| Model supply-chain risk | deployments with evidence and license metadata, profiles as Published assets |
| Secret leakage | broker issuances, redaction detectors, immediate revocation and finding |
| Cross-tenant retrieval | scope filters before top-k, tenant-scoped memory, consent for Shared |
| Poisoned knowledge | provenance and trust tiers, source classification, review before promotion |
Data classification¶
Governance data is Restricted; it is never promoted, exported only through the audit export with chain proofs, and never leaves the tenant's region.
Audit of the auditors¶
Every change to bundles, rules, classifications, references and findings is itself evidence; verification results are evidence; the chain head signatures are the proof that the proof was not altered.