Security Posture

Rule executions are logged

Every rule execution writes to the rule_executions table. Query history: /api/rules/execution/history. Statistics: /api/rules/execution/statistics.

Memory retrieval is logged

Every chat turn writes a row to retrieval_events: which memories were surfaced, scored, and cited. Schema in memory/retrieval_events.py.

Tenant wall: every query scoped to your tenant

Every read and write carries the client_id derived from the authenticated API key — as a filter condition inside the query itself, never as an after-the-fact check. Data from another tenant is not filtered out of results; it is never a candidate.

Within-tenant walls: the access gate

Memory carries labels (compartment, classification level, owners); every request resolves to a principal with clearances held in a platform-owned ledger. The two meet as filter conditions compiled into the retrieval query, before any model is called. Owner-labeled memory returns only to its owners — fail-closed for anonymous requests — including chat transcripts and thread history. Grants are conflict-checked; revocation takes effect on the next request.

Every gated read is audited

Each governed retrieval writes one row to an append-only audit ledger: who asked, under which authority, what was surfaced. Audit records are never rewritten — corrections are new entries.

Version is queryable

Commit SHA and deploy timestamp are exposed at /version. Use this to confirm exactly what binary is running.