{"slug":"platform/14-security-architecture","title":"14 — Security Architecture","section":"platform","sectionLabel":"Platform","status":"unclassified","type":"document","path":"platform/14-security-architecture.mdx","bytes":2071,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n> **EXTRACTED / NOT CANONICAL.** Descope authority and any conflicting identity\n> rules below are superseded by the Clerk/Gateway/tenant contract in\n> [`../architecture/IMPLEMENTATION_CONTRACT_v1.1.md`](../architecture/IMPLEMENTATION_CONTRACT_v1.1.md).\n\n> **Extracted from:** IntegrateWise Platform Specification Suite\n> **Region:** first_pass\n> **Original line:** 1197\n> **Lines:** 32 | **Chars:** 1,434\n> **Status:** Raw extraction — requires review and canonicalization\n\n14 — Security Architecture\n14.1 Responsibilities\nZero Trust model at the Gateway and Worker level.\nTenant isolation, secrets, keys, encryption, RBAC inheritance, ABAC, sessions.\n14.2 Tenets\nEvery request is authenticated.\nEvery request is authorized for the specific tenant + workspace + entity.\nSecrets never leave the Vault.\nEncryption at rest (D1+R2) and in transit (HTTPS).\n14.3 Tenant isolation\nLogical: row-level multi-tenancy via tnt_id predicate in every query.\nPhysical: per-tenant D1 partition (tnt_id sharding key) + per-tenant DO.\nNetwork: egress to connectors only via the authorized outbound connection layer (Descope as canonical authorization authority, Nango retained as dormant compatibility) + allowlist.\n14.4 Secret management\nCloudflare Secrets + KMS-backed envelope.\nKey rotation cadence: 90 days for connector tokens; 30 days for signing keys.\n14.5 RBAC inheritance\nRoles (rbac_roles) inherit capabilities and permissions.\nrbac_users.scope is the persona barrier.\n14.6 ABAC layer\nAttribute-based decisions supplement RBAC: time-of-day, region, device posture, signal severity.\n14.7 Session management\nShort-lived signed JWTs (≤30 min), refresh-token chain bound to device fingerprint.\nRe-auth required on tenant switch.\n14.8 Events\nSecurityAlert, SecretRotated, KeyRotated, SessionAnomalous.\n14.9 APIs\nGET /security/policies, POST /security/secrets/{name}/rotate, POST /security/sessions/{sid}/revoke.\n14.10 Failure handling\nRepeated anomalies → account lock + alert (16).\n14.11 Extension points\nABAC pluggable via POLICY_PACK(name).\n"}