Security
A technical evaluator has three questions: who can get in, how far an unauthenticated caller gets, and what leaks into a log. This page answers all three, in that order.
The gate is closed by default
The serving process requires a credential. Starting with no gate exists as an explicit option and announces itself on every boot — it is not an inherited default, and it cannot be reached by accident.
How far an unauthenticated caller gets
The gate runs before the body. A caller without a valid credential causes two indexed queries and nothing else: no body byte read, no JSON or XML parsing, no artifact loaded, no execution permit taken.
That is also where a refusal comes from that looks odd until it is explained: a caller with no credential announcing an oversized body gets an authentication refusal, not a size refusal. The ceiling is internal installation state and is not disclosed before authentication.
The tenant is a registered entity
- A tenant is created deliberately, with a command. Publishing a flow under a tenant name that does not exist does not create it implicitly — a typo does not silently become a real tenant.
- An unknown tenant and a disabled one answer identically from outside, with the same body as a flow that does not exist. The catalogue of what an installation holds is not disclosed.
- A library reference resolves within the caller’s tenant, and the compiled artifact carries that tenant’s copy.
What does not reach a log or an error
- A runtime error message carries the shape, not the content: no error site in the executor interpolates a value from the message.
- A backend response’s sensitive headers are withheld at capture, so they never become available to the flow — they are not filtered later out of a set that held them.
- Headers received from the backend reach the caller only through a declared allowlist. With no list, none passes: disclosure happens by declaration, never by omission.
Roles in the management UI
The UI has roles with an enforced boundary: every route answers every role exactly as the role table says. The boundary is verified route by route, role by role, not assumed from a menu not showing an entry.
The verdict of a handled delivery
A delivery that exits through the fault sequence is not committed as a success. The consequence matters exactly where it hurts: a corrected duplicate of the same key runs, instead of being handed back the memoised error response.
Artifacts, environment and cryptographic material
- Artifacts live in a content-addressed store, and the hash is verified on every read.
- A local environment file fills in the environment, but never overrides it.
- Certificates live in a registry; replacing one keeps the history, and a certificate nearing expiry leaves an event.
What the platform does not do
TLS is not terminated in the platform — termination happens in front of it, at the reverse proxy. And there is no WS-Security: a credential inside a message body does not authenticate, because the gate decides before a body exists.