Security model
Understand the main trust boundaries for projects, deployment, commands and agents.
Project and organization scope
Every protected action is authorized through current organization membership and project ownership. Engineering Seats and subscription state are rechecked for privileged agent and MCP operations.
Deployment trust
Production bundles use canonical content and Ed25519 signatures. Site Runtime verifies its configured trust key before activation and rejects invalid or policy-incompatible packages.
Secrets
Passwords, private keys, protocol credentials and Runtime management tokens do not belong in ordinary project configuration. Site-local secrets remain in the Runtime secret boundary. Organization BYOK provider keys are encrypted by the web server and are not returned to browsers or MCP clients.
Operator writes
A UI-selected identifier is never sufficient to write a device. Runtime resolves the command from the active bundle, verifies the command mapping and writable Point, performs bounded execution and records audit state.
Agent boundary
Built-in agents and external MCP clients receive bounded project context. Their write capability creates a proposal for human review. They cannot apply a proposal, deploy a revision, roll back Runtime or issue Runtime commands.