Skip to content

Generated SaaS — security

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Service Auth Scopes Tenant isolation Max side-effect class
GeneratedSaasFoundations oauth2-jwt product.admin.read product.admin.write per-request-claim shared-write
GeneratedProductHost oauth2-jwt product.admin.read product.admin.write product.health.read per-request-claim production

Principles

  • The product owns its customers' identity. Authentication and authorization run in the product through the Authorization Server template (canonical ADR-0101); the Factory never holds a customer credential or sees a customer identity.
  • Isolation is canonical. Row filter, schema per tenant or database per tenant per canonical ADR-0100, chosen in the Agentic SaaS Product Blueprint; the Factory inventories the mode, never changes it.
  • Residency per tenant. A product tenant's region satisfies the owner's residency rule (D31); the fleet never moves data across regions without a migration order.
  • One door for the Factory. Fleet operations reach a product only through its gateway (GW-07) with the product's own authorization and an opaque customer-tenant id; export and delete are admin operations invoked by governance orders after an acknowledged handover.
  • Generated code inherits the Factory's gates. Security Blueprint rules, pipeline security scans, SBOM and attestations, evaluation evidence of the generating agents, and promotion approvals apply to every release before it reaches a customer.

Scopes and roles (product side)

Scope Grants Roles
product.admin.read descriptor, tenants, subscriptions, handover Product owner, Fleet operator, Observer
product.admin.write provision and change tenants, acknowledge handover, export and delete on orders Product owner; governance orders through the fleet
product.health.read health probes fleet probes, gateways
the product's own business scopes the product's domain operations the product's customers and users (defined by its Security Blueprint)

Threats and controls

Threat Control
Factory operator reads customer data no data path; admin operations are export (to the customer) and delete (on order); audited
Cross-tenant leakage inside a product canonical isolation mode; TenantId on every table (DB-002); per-request claim
Compromised generated dependency SBOM, scans and attestations per release; marketplace listings only with evidence
Deletion before handover the off-boarding saga orders export, acknowledgement, then deletion; the product refuses delete without the order reference
Spoofed descriptor the fleet reads the descriptor through GW-07 under the product's authorization; provenance names Published releases the registry can verify