Enterprise AI Platform security

Version française : ../README.md

Pages

Page	Content
threat-model.md	Assets, trust boundaries, attacker profiles, STRIDE per layer
injection-matrix.md	One row per attack class: control, setting, proving test, residual risk
configuration.md	Security EAI_* settings, production startup guard, tenant security settings, posture API, Helm keys
runbooks.md	Incident procedures
testing.md	Running security tests and scanners locally and in CI
identity-context-delegation.md	Context Authority, signed ExecutionContext, delegations, mandates, break glass, four eyes, audit identity fields
soc-runbook.md	SOC and AI-SDR: detections, correlation, risk, typed reactions, Kill Switch Registry and receipts, recovery with four eyes, evidence chain of custody, transaction reconciliation
governance.md	Governance overview: who decides, controls per layer, registry, policies, audit, SOC, periodic review
hardening.md	Hardening checklist of a production installation, step by step
authentication-authorization.md	Accepted credentials, Keycloak OIDC, local accounts, API keys, SPIFFE, tenant resolution, roles, OpenFGA, OPA, group mappings
identity-policy-plane.md	Operator guide for Keycloak, SPIRE, OpenFGA, OPA and signed bundles, KMS and HSM
secrets-vault.md	Tenant secrets, Transit encryption keys, platform keys, IT vault of the Control Plane
file-security-pipeline.md	Quarantine, ClamAV, YARA-X, verdicts, locked rules, blocked files, roles and evidence
approvals.md	Approval workflow, run approvals, promotions, change path, four eyes rules
retention-privacy.md	Classification, DLP, tokenization, retention, legal holds, erasure, consents
data-protection.md	RAG data protection, Docling and PaddleOCR toolchains, quarantine review
risk-compliance.md	AI Act risk register, governance registry, evidence, control catalogue and frameworks
audit-evidence.md	Audit Gateway and Evidence Service: guarantees, roles, settings, offline verification

Related operations pages (not duplicated here):

• Network and DNS hardening
• Gateway and WAF
• Pod security
• Data services hardening
• CI security gates
• Infrastructure security hardening
• Platform secrets
• Compliance mapping
• SIEM and audit
• File security guide
• API contract, section Security (cross-cutting)

Principles

1. Defense in depth. A request goes through the portal (CSP with nonce, safeHref), the APISIX gateway with Coraza and the OWASP CRS, Cilium policies, then the Control Plane API (size limits, rate limiting, authentication, RBAC, RLS). No layer assumes the previous one did its job.
2. Every layer enforces its own control. Example: the WAF filters obvious SSRF, but eai.security.egress revalidates every resolved address at connect time, and Cilium denies the cloud metadata address anyway.
3. Deny by default. Default deny network (deploy/cilium/baseline.yaml), outbound HTTP to private addresses refused unless explicitly allowlisted (EAI_EGRESS_PRIVATE_ALLOWLIST), JWT algorithms limited to an asymmetric list, startup guard refusing an unsafe production configuration (eai.security.startup.enforce).
4. Tenant isolation by PostgreSQL RLS. eai.db.tx sets the transaction tenant; RLS policies filter every row. A resource of another tenant answers 404 (test_cross_tenant_access_is_404). RLS is forced on every tenant table (FORCE ROW LEVEL SECURITY, migration V100): even a connection that owns the tables, without the switch to the eai_app role, only sees what the policies admit, and the system context goes through eai.is_platform() (test_core_rls_forced.py).
5. Secrets are never exposed to agents. Secrets live in OpenBao (EAI_OPENBAO_URL) or are encrypted with EAI_MASTER_KEY; tools, MCP and connectors get references, never the clear value in the prompt. SDKs mask keys (eai_***) and the CLI masks them in config show.

Security events are written by eai.security.security_event to the tenant audit chain (only logged without a tenant), see runbooks.md.