← Back to Security

Security Architecture

Overview

AuthBoundry security is built on five core principles:

  1. Explicit Authority — Authority is never implicit. Every capability is explicit and enumerated.
  2. Least Privilege — Authority is granted at the narrowest scope necessary.
  3. Fail-Closed Enforcement — Default to DENY; ALLOW requires affirmative policy.
  4. Durable Evidence — All authorization decisions are recorded immutably.
  5. Auditable Change — Every change to authority is tracked and traceable.

Authority Model

AuthBoundry implements a rigorous separation between identity and authority:

Identity → Session → Principal → Claims → Delegation → Policy → Capability → Authorization → Evidence

Security Claims

✓ VERIFIED

Explicit capability authorization, fail-closed enforcement, tenant isolation, authorization evidence, session validation

⏳ NOT YET VERIFIED

Production deployment, live GitHub OAuth, backend infrastructure

⊘ NOT CLAIMED

SOC 2 compliance, encryption at rest, specific uptime guarantees

Full Documentation

See docs/security/SECURITY_EVIDENCE_REGISTER.md for complete control mapping with implementation details, evidence, and verification status.