Security and TrustIndex

Security and trust on this platform rests on one idea: every component holds a verified, scoped credential it must present to act — not an inherited grant of trust. That discipline shows up across five areas: who's known to the system and what they're allowed to do, how a reader independently verifies a record hasn't been altered, what contains a compromise once one occurs, how data is handled and kept private, and the controls that keep code honest from a contributor's machine to production.

A diligence reader's real question is can this be trusted? An engineer's is usually narrower — how does capability-based access control actually work? Both start below.

Start here: Capability-based security — the access-control model the whole category is named for: components hold verified cryptographic tokens instead of ambient privilege. One software layer implements it today; kernel-level enforcement is planned.

Identity and permissions

Who is known to the system, how a device proves it, and what it's allowed to do.

• Capability-based security — the access-control model: components hold verified cryptographic tokens instead of ambient privilege
• Machine-based authorization — pairing hardware to hardware replaces passwords; the pairing itself is the permission
• Personnel and permissions — how contributor identity and the four permission tiers are expressed through pairings, not database roles
• Identity ledger schema design — the Person/Anchor/Claim record types behind Ring 1 identity resolution
• Verification surveyor — the human-in-the-loop checkpoint that confirms an extracted identity before it's committed

Cryptographic verification

How a reader independently checks that a record hasn't been altered.

• Cryptographic payload attestation — client-side SHA-256 hashing that would let any viewer verify published content wasn't changed in transit; today it's an unwired, cosmetic pattern in a few templates, not a capability any shipped surface actually offers
• Cryptographic ledgers — the immutable-state storage pattern: hash-chained entries, signed checkpoints, monthly Sigstore Rekor anchoring

Isolation boundaries

What contains a compromise once one occurs. Thin relative to the category's own scope — see the tenant isolation and VM tenant articles in Where It Runs for the commercially load-bearing case, which isn't yet cross-referenced from here.

• seL4 capability topology — why security in an seL4 system is the shape of the capability graph, not a policy layer
• Diode standard — the unidirectional authority-to-subject command flow that removes lateral movement by design
• Genesis protocol — the fleet-bootstrapping sequence a node runs at first boot to reach a secure, claimable state

Data handling and privacy

• Data sovereignty and zero-state telemetry — the platform's only article on this clause today; retention, deletion, and encryption-at-rest have no dedicated article yet

Supply-chain controls

Keeping code honest from a contributor's machine to production.

• Five-stage supply chain — the contributor-to-customer promotion path, gated by a heavily guarded promotion script rather than a pull request, and the double-blind air-gap between contributor and customer
• Pre-commit defense in depth — the helper-only gate, secret-pattern scan, and size guard that run on every commit

What this is not

This page is not a substitute for reading the linked articles — each group's one-line annotation orients, it doesn't replace the underlying mechanism's own caveats and "what this is not" section. It is not exhaustive of every security-relevant fact in this wiki: isolation boundaries in particular are thin here because the commercially load-bearing tenant-isolation work lives in Where It Runs, not this category. It is not a compliance attestation — several linked articles describe planned, not-yet-built mechanisms, hedged accordingly in their own text.

See also

• Architecture — how the platform is put together
• Governance and Standards — what was decided and why it is compliant
• Where It Runs — the deployed storage and ledger infrastructure these mechanisms protect