Observability — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| AlertRuleService |
client-credentials |
factory.operations.read factory.operations.operate factory.operations.admin |
row-filter |
shared-write |
| DashboardService |
client-credentials |
factory.runs.read factory.operations.read factory.operations.admin |
row-filter |
shared-write |
| FeedbackService |
client-credentials |
factory.feedback.write factory.feedback.read factory.evaluation.read factory.evaluation.run factory.assets.write |
row-filter |
shared-write |
| ObservabilityHost |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
publication |
| QualityScoreService |
client-credentials |
factory.evaluation.read factory.evaluation.run factory.evaluation.waive |
row-filter |
publication |
| SloService |
client-credentials |
factory.operations.read factory.operations.admin |
row-filter |
shared-write |
Principles
- No content, only references. Timelines, overviews, alerts and evidence hold hashes and receipt or artifact references; prompts, responses and files stay with their owners under their own permission checks (D31: no raw prompt or response logging by default).
- Row-filtered everything. Every table carries
TenantId and every query runs under the caller's execution scope; platform-level objectives and health use the platform tenant.
- Evaluation runs are ordinary runs. They execute under the evaluation project with sandbox-class tools only, carry receipts, are attributed to the evaluation and cannot reach shared-write, external or production classes (D21).
- Waivers are publication-class actions. A waiver binds an approval to the exact evaluation id; the evidence record says the verdict was waived, by whom and why (ADR-0015, ADR-0021).
- Thresholds are not the author's. Suite thresholds are set by Platform admin through the suite asset; an Asset maintainer cannot lower the bar for their own release (D18 separation of duties).
- External delivery is a connector call. Chat and email notifications go through
ConnectorRegistryService with the external class and the tenant's own connection; the Studio notification is always delivered regardless.
- Datasets are tenant data. Tasks harvested from a tenant's runs stay in that tenant; sharing needs anonymisation and consent (D32), checked through the memory-promotion consent model.
Scopes and roles
| Scope |
Grants |
Roles |
factory.runs.read |
run projections in scope |
Requester, Reviewer, Operator, Observer |
factory.operations.read |
overviews, objectives, health, alerts, rules |
Operator, Workspace admin, Platform admin, Observer |
factory.operations.operate |
acknowledge and resolve alerts |
Operator |
factory.operations.admin |
objectives, rules, projection rebuilds |
Workspace admin, Platform admin |
factory.evaluation.read |
suites, evaluations, verdicts, datasets, proposals |
Asset maintainer, Reviewer, Platform admin, Observer |
factory.evaluation.run |
start evaluations, snapshot datasets |
Asset maintainer, Platform admin |
factory.evaluation.waive |
waive a verdict (approval required) |
Reviewer (approver), never the maintainer of the release |
factory.feedback.write / .read |
record and read feedback |
Requester, Reviewer, Operator |
factory.assets.write |
decide proposals |
Asset maintainer |
Threats and controls
| Threat |
Control |
| Evaluation gaming (a maintainer tunes the dataset to pass) |
datasets snapshot immutably; suites pin a snapshot; thresholds owned by Platform admin; baseline rule compares against the previous release |
| Exfiltration through evaluation tasks |
sandbox-class tools only; egress policy of the sandbox; receipts on every call |
| Cross-tenant leakage through overviews |
row filters; overviews keyed by tenant; platform aggregates exclude tenant identifiers |
| Alert flooding or spoofed sources |
rules fire only from signed internal events or authenticated metric queries; deduplication; suppression windows |
| Proposal injection (a poisoned proposal text) |
proposals are artifacts reviewed by a maintainer; acceptance opens a Draft release that is evaluated; no auto-apply |