Security model

DRC protects execution evidence through tenant-scoped authorization, bounded inputs, integrity verification, and explicit storage authorities.

Tenant boundaries

Hosted requests resolve identity from PostgreSQL and require the authenticated tenant to match every execution, project, integration, evidence, and content operation. A missing or cross-tenant reference fails closed.

Evidence integrity

Captured events are written through the selected storage authority. Sealed segments and portable evidence bundles carry digest and signature metadata. Verification reports whether bytes and signer identity were verified; metadata-only records are not presented as verified evidence.

Secrets

Provider credentials are represented by managed credential references. They are not included in public API responses, editorial revisions, issue descriptions, audit details, or support bundles. Store private keys in a secret manager or protected file path, never in a CRD or ConfigMap.

Redaction and retention

Payloads are redacted by policy. Retention, deletion, legal holds, and exports are tenant-scoped and controlled by the hosted lifecycle authority. Before sharing a replay or evidence bundle, confirm that its retention and access policy permits the recipient.

Deployment security

Production deployments should enforce:

• TLS at every exposed boundary.
• Immutable image digests and verified provenance.
• Signed admission decisions where deployment gates are enabled.
• Database, Redis, and object-store network isolation.
• Key rotation and credential revocation procedures.
• Dependency and container vulnerability scanning.

Security reporting

Report a suspected vulnerability through the security contact published by your DRC service operator. Do not include production payloads, credentials, or private evidence in an initial report.