Security Control Plane

Does CodexDominion know its own security posture? This evaluates the platform itself — deterministically, no external calls.

This is a platform-security posture for DEMO and PILOT evaluation. It does not certify production security — production requires verified session identity, a persistent database, tenant isolation, backups, and managed secrets.

Security posture is computed over the same platform that Organization Memory indexes.See evidence coverage and proof-packet blockers behind this posture in the Evidence Graph.See the governed workflows these controls run inside, in the Workflow Engine.See the read-only integration posture (no live connection, no credentials, no write-back).See security health within overall platform health in the Observability Console.

Platform Security Score

Security score 0/100 — status BLOCKED. Demo-secure: no; Pilot-secure: no; Production: blocked. 5 critical risk(s), 5 production blocker(s).

0/ 100

BLOCKED

Demo security

at risk

Pilot security

not ready

Production security

blocked

Environment

production

Export security report (Markdown)

Critical Risks

⚠ [CRITICAL] Identity & session verification
⚠ [HIGH] Tenant isolation
⚠ [HIGH] Secrets management
⚠ [HIGH] Persistent database
⚠ [HIGH] Backups & recovery

Warnings

• API security (validation & rate limiting)

Production Blockers

Identity & session verification
Tenant isolation
Secrets management
Persistent database
Backups & recovery

Security Controls (15 categories)

One control per category, evaluated against the live posture.

Category	Control	Severity	Status	Detail
IDENTITY	Identity & session verification	CRITICAL	BLOCKED	Identity is an unsigned mock/pilot actor — not a verified session.
ACCESS_CONTROL	Role-based access control	INFO	SECURE	Export and approval are permission-gated via @merritt/workspace.
TENANT_ISOLATION	Tenant isolation	HIGH	BLOCKED	Per-tenant data isolation is not yet verified.
AUDIT	Audit logging & chain integrity	INFO	SECURE	Decision/audit events are recorded with verifiable chain integrity.
API_SECURITY	API security (validation & rate limiting)	MEDIUM	WARNING	Inputs are validated, but rate limiting is not yet enabled.
SECRETS	Secrets management	HIGH	BLOCKED	Production secrets are not configured.
DATABASE	Persistent database	HIGH	BLOCKED	No persistent database — running on in-memory / seed data.
BACKUPS	Backups & recovery	HIGH	BLOCKED	Backups and recovery are not verified.
DEPENDENCIES	Dependency integrity	INFO	SECURE	Dependencies are pinned with no known vulnerabilities.
AI_SECURITY	AI safety (no autonomous finalization)	INFO	SECURE	AI never finalizes decisions; human approval is required; prompt injection is mitigated.
RESEARCH_SECURITY	Research integrity	INFO	SECURE	Research sources are manually captured and reviewed — no autonomous crawling.
DOCUMENT_SECURITY	Document verification	INFO	SECURE	Documents are verified (Veritaxis) for completeness and trust before use.
EXPORT_SECURITY	Export authorization	INFO	SECURE	Proof-packet export requires authorization (EXPORT_PROOF_PACKET).
NETWORK	Network / external surface	INFO	SECURE	No live external providers or outbound crawling — minimal attack surface.
CONFIGURATION	Configuration & data handling	INFO	SECURE	Configuration is pinned and no real customer data is in use.

Threat Model

21 threats — likelihood × impact, mitigation status.

Threat	Severity	Status
Broken Access Control POSSIBLE · CRITICAL · mitigated	HIGH	SECURE
Privilege Escalation UNLIKELY · CRITICAL · OPEN	HIGH	AT RISK
Prompt Injection LIKELY · HIGH · mitigated	HIGH	SECURE
Malicious Research POSSIBLE · HIGH · mitigated	HIGH	SECURE
Document Poisoning POSSIBLE · HIGH · mitigated	HIGH	SECURE
Fake Citations POSSIBLE · MEDIUM · mitigated	MEDIUM	SECURE
Unauthorized Export POSSIBLE · HIGH · mitigated	HIGH	SECURE
Tenant Leakage POSSIBLE · CRITICAL · OPEN	HIGH	AT RISK
Database Exposure UNLIKELY · CRITICAL · OPEN	HIGH	AT RISK
API Abuse LIKELY · MEDIUM · OPEN	MEDIUM	WARNING
Credential Theft POSSIBLE · CRITICAL · OPEN	HIGH	AT RISK
Secret Leakage POSSIBLE · CRITICAL · mitigated	HIGH	SECURE
Replay Attack UNLIKELY · HIGH · OPEN	MEDIUM	WARNING
Supply Chain Attack POSSIBLE · HIGH · mitigated	HIGH	SECURE
Dependency Attack POSSIBLE · HIGH · mitigated	HIGH	SECURE
Audit Tampering UNLIKELY · HIGH · mitigated	MEDIUM	SECURE
Model Hallucination LIKELY · MEDIUM · mitigated	MEDIUM	SECURE
Unauthorized AI Action POSSIBLE · CRITICAL · mitigated	HIGH	SECURE
Insider Threat UNLIKELY · HIGH · mitigated	MEDIUM	SECURE
Denial of Service POSSIBLE · MEDIUM · OPEN	MEDIUM	WARNING
Configuration Drift POSSIBLE · MEDIUM · mitigated	MEDIUM	SECURE

Policy Compliance

15 platform-security policies.

Policy	Result	Status
Verified identity required	fail	BLOCKED
No pilot fallback in production	pass	SECURE
RBAC required	pass	SECURE
Audit required	pass	SECURE
Tenant isolation required	fail	BLOCKED
Persistent database required	fail	BLOCKED
Backups required	fail	BLOCKED
Secrets configured	fail	BLOCKED
No hardcoded secrets	pass	SECURE
Proof packet export gated	pass	SECURE
Approval gated	pass	SECURE
AI never finalizes decisions	pass	SECURE
Research manually reviewed	pass	SECURE
Truth Engine required	pass	SECURE
Human approval required	pass	SECURE

Route Protection Review

Deterministic evaluation only — no rate limiting is added.

Route	Method	Permission	Identity	Audit	Rate Limited	Prod-Ready	Risk
/api/financial-governance/proof-packet/export	GET	EXPORT_PROOF_PACKET	yes	yes	no	no	WARNING
/api/financial-governance/decision-record/approve	POST	APPROVE_DECISION	yes	yes	no	no	WARNING
/api/security/report	GET	—	no	no	no	yes	SECURE

Integration Posture

External-provider stance — read-only contracts only.

External providers disabled / config-required — 15 future, 6 config-required adapters; none live.
No credentials configured — 0 adapters require credentials.
No live write-back — 0 adapters allow write-back to core systems.

Next Actions

To move from demo/pilot toward production security.

• [IDENTITY] Integrate a verified session provider (Phase 5) before production.
• [TENANT_ISOLATION] Verify row-level / tenant scoping before storing multi-tenant data.
• [SECRETS] Configure secrets via the environment / a secrets manager before production.
• [DATABASE] Configure a persistent (non-SQLite-file) DATABASE_URL with least-privilege access.
• [BACKUPS] Configure automated backups and verify recovery before production.
• Policy 'Verified identity required': VIOLATION: Actions must be attributable to a verified, signed session.
• Policy 'Tenant isolation required': VIOLATION: Tenants must not be able to access each other's data.
• Policy 'Persistent database required': VIOLATION: Customer data requires a persistent, access-controlled store.
• Policy 'Backups required': VIOLATION: Backups and a tested recovery path are required.
• Policy 'Secrets configured': VIOLATION: Production secrets must be sourced from the environment / a vault.