Security engineer
You answer for the platform's trust: who may sign in, what a signed-in caller may reach, which secrets exist and who holds them, and what happens when one leaks. This page maps those questions to the pages that answer them and to the playbooks you run.
The trust model in one paragraph#
A tenant's identity provider says who a caller is; Access maps that identity to a principal and decides, from grants alone, what the principal may do; the gateway enforces the decision and signs the caller's identity into every request it forwards; Data and other upstreams trust only that signature. Every hop fails closed. The full model, with each boundary and the secret that guards it, is in Platform security.
Start here#
- Platform security: trust boundaries, secrets, least privilege.
- Gateway spec §5, §6 and §7.4: how callers are authenticated, checked and signed.
- Access spec §5, §8 and §4: login brokering, decisions and secret handling.
- Data spec §4 and §8: what Data trusts and how it authorizes each record.
- Respond to an incident, so you know the playbook before you need it.
Common tasks#
| Task | Guide or page |
|---|---|
| Rotate a secret, or all of them | Rotate secrets |
| Cut off a user or a tenant now | Respond to an incident |
| Revoke access the normal way, and know how long it takes | Manage access, Access spec §8.6 |
| Review who changed what | Manage access, Access API: administration |
| Harden an Access deployment | Access operations: hardening |
| Review a gateway deployment | Gateway operations: deployment review |
| Check an upstream verifies identities correctly | Upstream identity |
| Report or receive a vulnerability | SECURITY.md |
Secrets by service#
| Service | Its secrets | Where they are described | Where they are rotated |
|---|---|---|---|
| Gateway | Session secret, identity signing key, OIDC client secret, Access token, upstream TLS client key, metrics and control-plane tokens | Gateway configuration | Gateway operations: secrets |
| Access | State secret, secret encryption key, signing key, administration, decision and context tokens, metrics token | Access configuration, Access spec §4 | Access operations: rotating secrets |
| Data | Cursor key, access context credential, the gateway's public identity key, metrics token | Data configuration: deployment artifacts | Data operations: rotating secrets |
| Console | Session secret, its Access client secret, platform and per-tenant administration tokens, access context token | Console operations: credentials it holds | Console operations: rotating secrets |
Security reviews and open findings#
| Service | Review | Open findings |
|---|---|---|
| Gateway | Gateway security policy | Gateway internals: known gaps |
| Access | Access internals: security review | Access internals: open findings |
| Data | Data internals: review | Data internals: open findings |
When something looks wrong#
| Signal | Where to look |
|---|---|
A spike of 403 workspace_forbidden or denial reasons | Gateway spec §6.5, Access troubleshooting: decisions denied |
| Repeated failed sign-ins | Access spec §5.6, Access troubleshooting: failed logins |
403 cross_site_request from browsers | Gateway troubleshooting: cross-site guard |
| An upstream rejects the identity signature | Gateway troubleshooting, Upstream identity: failed verification |
Data answers 401 UNAUTHENTICATED | Data troubleshooting |
| A revoked caller keeps access | Gateway troubleshooting |