Security and TrustIndex

This page indexes the 13 articles in the security category. It covers identity and permissions, cryptographic verification, isolation boundaries, how data is handled and kept private, and the supply-chain controls designed to keep code honest from contributor to production.

This is the platform's answer to the diligence reader's question — can this be trusted? — and the front door for engineers looking up a specific security mechanism: capability-based access control, machine-based authentication, attestation, cryptographic ledgers, and the trust-establishment bootstrap a device passes through before it joins a deployment.

Start here: Capability-based security — the access-control model the whole category is named for: components hold verified cryptographic tokens instead of ambient privilege. One software layer implements it today; kernel-level enforcement is planned.

Identity and permissions

Who is known to the system, how a device proves it, and what it's allowed to do.

• Capability-based security — the access-control model: components hold verified cryptographic tokens instead of ambient privilege
• Machine-based authorization — pairing hardware to hardware replaces passwords; the pairing itself is the permission
• Personnel and permissions — how contributor identity and the four permission tiers are expressed through pairings, not database roles
• Identity ledger schema design — the Person/Anchor/Claim record types behind Ring 1 identity resolution
• Verification surveyor — the human-in-the-loop checkpoint that confirms an extracted identity before it's committed

Cryptographic verification

How a reader independently checks that a record hasn't been altered.

• Cryptographic payload attestation — client-side SHA-256 hashing that would let any viewer verify published content wasn't changed in transit; today it's an unwired, cosmetic pattern in a few templates, not a capability any shipped surface actually offers
• Cryptographic ledgers — the immutable-state storage pattern: hash-chained entries, signed checkpoints, monthly Sigstore Rekor anchoring

Isolation boundaries

What contains a compromise once one occurs. Thin relative to the category's own scope — see the tenant isolation and VM tenant articles in Where It Runs for the commercially load-bearing case, which isn't yet cross-referenced from here.

• seL4 capability topology — why security in an seL4 system is the shape of the capability graph, not a policy layer
• Diode standard — the unidirectional authority-to-subject command flow that removes lateral movement by design
• Genesis protocol — the fleet-bootstrapping sequence a node runs at first boot to reach a secure, claimable state

Data handling and privacy

• Data sovereignty and zero-state telemetry — the platform's only article on this clause today; retention, deletion, and encryption-at-rest have no dedicated article yet

Supply-chain controls

Keeping code honest from a contributor's machine to production.

• Five-stage supply chain — the contributor-to-customer promotion path, gated by a heavily guarded promotion script rather than a pull request, and the double-blind air-gap between contributor and customer
• Pre-commit defense in depth — the helper-only gate, secret-pattern scan, and size guard that run on every commit

What this is not

This page is not a substitute for reading the linked articles — each group's one-line annotation orients, it doesn't replace the underlying mechanism's own caveats and "what this is not" section. It is not exhaustive of every security-relevant fact in this wiki: isolation boundaries in particular are thin here because the commercially load-bearing tenant-isolation work lives in Where It Runs, not this category. It is not a compliance attestation — several linked articles describe planned, not-yet-built mechanisms, hedged accordingly in their own text.

See also

• Architecture — how the platform is put together
• Governance and Standards — what was decided and why it is compliant
• Where It Runs — the deployed storage and ledger infrastructure these mechanisms protect