[{"data":1,"prerenderedAt":675},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Fgovernance":250,"\u002Fsecurity\u002Fgovernance-surround":670},[4,28,56,91,117,135,169,224],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Start here","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Decisions and open gates","\u002Fgetting-started\u002Fdecisions","1.getting-started\u002F2.decisions",{"title":16,"path":17,"stem":18},"Scope and non-goals","\u002Fgetting-started\u002Fscope","1.getting-started\u002F3.scope",{"title":20,"path":21,"stem":22},"Organization pilot","\u002Fgetting-started\u002Fpilot","1.getting-started\u002F4.pilot",{"title":24,"path":25,"stem":26},"Economics and quotas","\u002Fgetting-started\u002Feconomics","1.getting-started\u002F5.economics","i-lucide-compass",{"title":29,"path":30,"stem":31,"children":32,"icon":55},"Architecture","\u002Farchitecture","2.architecture\u002F1.index",[33,35,39,43,47,51],{"title":34,"path":30,"stem":31},"System architecture",{"title":36,"path":37,"stem":38},"Trust zones","\u002Farchitecture\u002Ftrust-zones","2.architecture\u002F2.trust-zones",{"title":40,"path":41,"stem":42},"Control plane","\u002Farchitecture\u002Fcontrol-plane","2.architecture\u002F3.control-plane",{"title":44,"path":45,"stem":46},"Organization tenancy","\u002Farchitecture\u002Ftenancy","2.architecture\u002F4.tenancy",{"title":48,"path":49,"stem":50},"Core data model","\u002Farchitecture\u002Fdata-model","2.architecture\u002F5.data-model",{"title":52,"path":53,"stem":54},"Codebase organization","\u002Farchitecture\u002Fcodebase","2.architecture\u002F6.codebase","i-lucide-layers",{"title":57,"icon":58,"path":59,"stem":60,"children":61,"page":90},"Identity and security","i-lucide-shield-check","\u002Fsecurity","3.security",[62,66,70,74,78,82,86],{"title":63,"path":64,"stem":65},"Identity and sessions","\u002Fsecurity\u002Fidentity","3.security\u002F1.identity",{"title":67,"path":68,"stem":69},"Domains and TLS","\u002Fsecurity\u002Fdomains","3.security\u002F2.domains",{"title":71,"path":72,"stem":73},"Ingress and egress","\u002Fsecurity\u002Fnetworking","3.security\u002F3.networking",{"title":75,"path":76,"stem":77},"Access policies and WAF-lite","\u002Fsecurity\u002Faccess-policies","3.security\u002F4.access-policies",{"title":79,"path":80,"stem":81},"Secrets and integrations","\u002Fsecurity\u002Fsecrets-integrations","3.security\u002F5.secrets-integrations",{"title":83,"path":84,"stem":85},"Governance and ownership","\u002Fsecurity\u002Fgovernance","3.security\u002F6.governance",{"title":87,"path":88,"stem":89},"Threat model","\u002Fsecurity\u002Fthreat-model","3.security\u002F7.threat-model",false,{"title":92,"icon":93,"path":94,"stem":95,"children":96,"page":90},"Building applications","i-lucide-code","\u002Fdevelopment","4.development",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"AI and MCP","\u002Fdevelopment\u002Fai-mcp","4.development\u002F1.ai-mcp",{"title":102,"path":103,"stem":104},"Source control","\u002Fdevelopment\u002Fsource-control","4.development\u002F2.source-control",{"title":106,"path":107,"stem":108},"Sandboxed builds","\u002Fdevelopment\u002Fbuilds","4.development\u002F3.builds",{"title":110,"path":111,"stem":112},"Runtime contract and SDK","\u002Fdevelopment\u002Fruntime-contract","4.development\u002F4.runtime-contract",{"title":114,"path":115,"stem":116},"APIs and protocols","\u002Fdevelopment\u002Fapi","4.development\u002F5.api",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":90},"Runtime and delivery","i-lucide-rocket","\u002Fdelivery","5.delivery",[123,127,131],{"title":124,"path":125,"stem":126},"Runtime clusters and previews","\u002Fdelivery\u002Fruntime-clusters","5.delivery\u002F1.runtime-clusters",{"title":128,"path":129,"stem":130},"Deployments and approvals","\u002Fdelivery\u002Fdeployments","5.delivery\u002F2.deployments",{"title":132,"path":133,"stem":134},"Databases and recovery","\u002Fdelivery\u002Fdata-recovery","5.delivery\u002F3.data-recovery",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":90},"Operations","i-lucide-activity","\u002Foperations","6.operations",[141,145,149,153,157,161,165],{"title":142,"path":143,"stem":144},"Observability and audit","\u002Foperations\u002Fobservability","6.operations\u002F1.observability",{"title":146,"path":147,"stem":148},"Operating model","\u002Foperations\u002Foperating-model","6.operations\u002F2.operating-model",{"title":150,"path":151,"stem":152},"Deploy and roll back","\u002Foperations\u002Fdeploy-rollback","6.operations\u002F3.deploy-rollback",{"title":154,"path":155,"stem":156},"Back up and restore","\u002Foperations\u002Fbackup-restore","6.operations\u002F4.backup-restore",{"title":158,"path":159,"stem":160},"Upgrade and patch","\u002Foperations\u002Fupgrades","6.operations\u002F5.upgrades",{"title":162,"path":163,"stem":164},"Rotate keys and credentials","\u002Foperations\u002Fkey-rotation","6.operations\u002F6.key-rotation",{"title":166,"path":167,"stem":168},"Incidents and access revocation","\u002Foperations\u002Fincidents","6.operations\u002F7.incidents",{"title":170,"path":171,"stem":172,"children":173,"icon":223},"Implementation plan","\u002Froadmap","7.roadmap\u002F01.index",[174,175,179,183,187,191,195,199,203,207,211,215,219],{"title":170,"path":171,"stem":172},{"title":176,"path":177,"stem":178},"Phase 0: architecture spikes and ADRs","\u002Froadmap\u002Fphase-0","7.roadmap\u002F02.phase-0",{"title":180,"path":181,"stem":182},"Phase 1: control-plane foundation","\u002Froadmap\u002Fphase-1","7.roadmap\u002F03.phase-1",{"title":184,"path":185,"stem":186},"Phase 2: managed source and change sets","\u002Froadmap\u002Fphase-2","7.roadmap\u002F04.phase-2",{"title":188,"path":189,"stem":190},"Phase 3: sandboxed build system","\u002Froadmap\u002Fphase-3","7.roadmap\u002F05.phase-3",{"title":192,"path":193,"stem":194},"Phase 4: runtime and data plane","\u002Froadmap\u002Fphase-4","7.roadmap\u002F06.phase-4",{"title":196,"path":197,"stem":198},"Phase 5: deployment, preview, migration, and recovery","\u002Froadmap\u002Fphase-5","7.roadmap\u002F07.phase-5",{"title":200,"path":201,"stem":202},"Phase 6: Entra identity and security policy","\u002Froadmap\u002Fphase-6","7.roadmap\u002F08.phase-6",{"title":204,"path":205,"stem":206},"Phase 7: MCP and AI-native workflow","\u002Froadmap\u002Fphase-7","7.roadmap\u002F09.phase-7",{"title":208,"path":209,"stem":210},"Phase 8: Pilot hardening","\u002Froadmap\u002Fphase-8","7.roadmap\u002F10.phase-8",{"title":212,"path":213,"stem":214},"Phase 9: developer hybrid and v1 GA","\u002Froadmap\u002Fphase-9","7.roadmap\u002F11.phase-9",{"title":216,"path":217,"stem":218},"Test strategy","\u002Froadmap\u002Ftesting","7.roadmap\u002F12.testing",{"title":220,"path":221,"stem":222},"Definition of done","\u002Froadmap\u002Fdefinition-of-done","7.roadmap\u002F13.definition-of-done","i-lucide-list-checks",{"title":225,"icon":226,"path":227,"stem":228,"children":229,"page":90},"Reference","i-lucide-book-open","\u002Freference","8.reference",[230,234,238,242,246],{"title":231,"path":232,"stem":233},"Plan coverage","\u002Freference\u002Fplan-coverage","8.reference\u002F1.plan-coverage",{"title":235,"path":236,"stem":237},"Decision register","\u002Freference\u002Fdecisions","8.reference\u002F2.decisions",{"title":239,"path":240,"stem":241},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary",{"title":243,"path":244,"stem":245},"Sources","\u002Freference\u002Fsources","8.reference\u002F4.sources",{"title":247,"path":248,"stem":249},"Contributing and docs access","\u002Freference\u002Fcontributing","8.reference\u002F5.contributing",{"id":251,"title":83,"body":252,"description":663,"extension":664,"links":665,"meta":666,"navigation":667,"path":84,"seo":668,"stem":85,"__hash__":669},"docs\u002F3.security\u002F6.governance.md",{"type":253,"value":254,"toc":646},"minimark",[255,271,276,352,355,359,364,386,390,410,414,431,435,455,458,462,465,468,479,482,486,489,578,582,585,591,594,611,615,621,624,630,633,637,640],[256,257,258],"note",{},[259,260,261,265,266,270],"p",{},[262,263,264],"strong",{},"v1 design baseline."," This page specifies intended behavior. Delivery and validation are tracked in the ",[267,268,269],"a",{"href":171},"implementation plan","; it is not a claim that the platform is already implemented.",[272,273,275],"h2",{"id":274},"organization-roles","Organization roles",[277,278,279,292],"table",{},[280,281,282],"thead",{},[283,284,285,289],"tr",{},[286,287,288],"th",{},"Role",[286,290,291],{},"Typical authority",[293,294,295,304,312,320,328,336,344],"tbody",{},[283,296,297,301],{},[298,299,300],"td",{},"Viewer",[298,302,303],{},"View permitted apps and deployments.",[283,305,306,309],{},[298,307,308],{},"Creator",[298,310,311],{},"Create apps, edit managed source, build, preview, request deployment.",[283,313,314,317],{},[298,315,316],{},"Developer",[298,318,319],{},"Git\u002FAPI access, advanced diagnostics, source ownership, technical maintenance.",[283,321,322,325],{},[298,323,324],{},"Deployer",[298,326,327],{},"Deploy within delegated risk\u002Fcapability limits.",[283,329,330,333],{},[298,331,332],{},"Approver",[298,334,335],{},"Approve designated deployment classes.",[283,337,338,341],{},[298,339,340],{},"Security Admin",[298,342,343],{},"Identity, IP lists, policies, secrets, integrations, capability approval.",[283,345,346,349],{},[298,347,348],{},"Org Admin",[298,350,351],{},"Organization-wide administration and role assignment.",[259,353,354],{},"Permissions should remain granular even if the UI initially presents role bundles.",[272,356,358],{"id":357},"risk-classes","Risk classes",[360,361,363],"h3",{"id":362},"sandbox","Sandbox",[365,366,367,371,374,377,380,383],"ul",{},[368,369,370],"li",{},"Synthetic data",[368,372,373],{},"Creator\u002Freviewer access only",[368,375,376],{},"No production integrations",[368,378,379],{},"No secrets",[368,381,382],{},"Short retention",[368,384,385],{},"Self-service preview",[360,387,389],{"id":388},"standard-internal","Standard internal",[365,391,392,395,398,401,404,407],{},[368,393,394],{},"Entra SSO",[368,396,397],{},"Normal internal workflow data",[368,399,400],{},"SQLite and KV",[368,402,403],{},"Controlled egress",[368,405,406],{},"Organization\u002Fgroup access",[368,408,409],{},"No regulated data",[360,411,413],{"id":412},"sensitive","Sensitive",[365,415,416,419,422,425,428],{},[368,417,418],{},"Privileged internal data",[368,420,421],{},"Secrets or external integrations",[368,423,424],{},"Broad departmental use",[368,426,427],{},"Expanded access policy",[368,429,430],{},"Stronger approvals and logging",[360,432,434],{"id":433},"regulated","Regulated",[365,436,437,440,443,446,449,452],{},[368,438,439],{},"Regulated data",[368,441,442],{},"Integrations subject to compliance requirements",[368,444,445],{},"Contractual\u002Fcompliance controls",[368,447,448],{},"Approved AI configuration",[368,450,451],{},"Dedicated policy and retention",[368,453,454],{},"Formal review",[259,456,457],{},"The v1 organization pilot enables only Sandbox and Standard Internal.",[272,459,461],{"id":460},"capability-driven-minimum-risk","Capability-driven minimum risk",[259,463,464],{},"The creator does not get to misclassify an app as low risk.",[259,466,467],{},"Examples:",[469,470,476],"pre",{"className":471,"code":473,"language":474,"meta":475},[472],"language-text","Requests only DB + KV + Entra SSO\n→ Standard may be sufficient\n\nRequests generic raw secret\n→ at least Sensitive\n\nRequests private-network connector\n→ at least Sensitive\n\nRequests regulated-data capability\n→ Regulated\n\nRequests public exposure\n→ security approval and organization permission\n","text","",[477,478,473],"code",{"__ignoreMap":475},[259,480,481],{},"An administrator may raise the risk class but may not lower it beneath the computed capability floor.",[272,483,485],{"id":484},"approval-matrix","Approval matrix",[259,487,488],{},"Pilot policy:",[277,490,491,501],{},[280,492,493],{},[283,494,495,498],{},[286,496,497],{},"Change",[286,499,500],{},"Approval",[293,502,503,510,518,526,533,540,548,555,562,570],{},[283,504,505,508],{},[298,506,507],{},"Sandbox preview",[298,509,308],{},[283,511,512,515],{},[298,513,514],{},"Standard internal production deployment",[298,516,517],{},"Authorized human approver",[283,519,520,523],{},[298,521,522],{},"Destructive migration",[298,524,525],{},"Authorized approver",[283,527,528,531],{},[298,529,530],{},"New external integration",[298,532,340],{},[283,534,535,538],{},[298,536,537],{},"Access expansion",[298,539,340],{},[283,541,542,545],{},[298,543,544],{},"Public exposure",[298,546,547],{},"Disabled",[283,549,550,553],{},[298,551,552],{},"Private network",[298,554,547],{},[283,556,557,560],{},[298,558,559],{},"Regulated-data capability",[298,561,547],{},[283,563,564,567],{},[298,565,566],{},"Organization policy",[298,568,569],{},"Security Admin\u002FOrg Admin",[283,571,572,575],{},[298,573,574],{},"AI self-approval",[298,576,577],{},"Never",[272,579,581],{"id":580},"application-ownership","Application ownership",[259,583,584],{},"Every production app has:",[469,586,589],{"className":587,"code":588,"language":474,"meta":475},[472],"Organization owner\nBusiness owner\nTechnical owner\u002Fmaintainer\nRisk class\nData classification\nLast review date\nNext review date\n",[477,590,588],{"__ignoreMap":475},[259,592,593],{},"When the creator leaves:",[365,595,596,599,602,605,608],{},[368,597,598],{},"App remains organization-owned.",[368,600,601],{},"Direct credentials are revoked.",[368,603,604],{},"Business\u002Ftechnical ownership is reassigned or flagged.",[368,606,607],{},"Production is not automatically deleted.",[368,609,610],{},"Administrators receive an orphaned-app alert.",[272,612,614],{"id":613},"lifecycle","Lifecycle",[469,616,619],{"className":617,"code":618,"language":474,"meta":475},[472],"Draft\nPreview\nProduction\nSuspended\nArchived\nPending Deletion\nPurged\n",[477,620,618],{"__ignoreMap":475},[259,622,623],{},"Inactivity policy examples:",[469,625,628],{"className":626,"code":627,"language":474,"meta":475},[472],"No production traffic for 180 days\n→ flag for review\n\nNo production traffic for 365 days\n→ archive candidate\n",[477,629,627],{"__ignoreMap":475},[259,631,632],{},"Deletion initially disables routes and starts a recovery window. Permanent purge follows organization retention policy.",[272,634,636],{"id":635},"governance-dashboard","Governance dashboard",[259,638,639],{},"Organization administrators should see:",[469,641,644],{"className":642,"code":643,"language":474,"meta":475},[472],"Production apps by risk class\nApps with external egress\nApps with integrations\nApps with destructive migrations pending\nApps missing owners\nApps overdue for review\nApps with broad network access\nApps with policy exceptions\nAI-created changes awaiting review\nBackup\u002Frestore health\nQuota consumption\n",[477,645,643],{"__ignoreMap":475},{"title":475,"searchDepth":647,"depth":648,"links":649},1,2,[650,651,658,659,660,661,662],{"id":274,"depth":648,"text":275},{"id":357,"depth":648,"text":358,"children":652},[653,655,656,657],{"id":362,"depth":654,"text":363},3,{"id":388,"depth":654,"text":389},{"id":412,"depth":654,"text":413},{"id":433,"depth":654,"text":434},{"id":460,"depth":648,"text":461},{"id":484,"depth":648,"text":485},{"id":580,"depth":648,"text":581},{"id":613,"depth":648,"text":614},{"id":635,"depth":648,"text":636},"Roles, risk classes, capability floors, approval authority, and organization-owned app lifecycles.","md",null,{},true,{"title":83,"description":663},"_lPaDRF-YioQeKdNbDDbqfbSTiGK033_Ub6iAGs-jNY",[671,673],{"title":79,"path":80,"stem":81,"description":672,"children":-1},"Encrypted secret versions, credential-injecting integration bindings, approvals, and rotation.",{"title":87,"path":88,"stem":89,"description":674,"children":-1},"Threats and controls for tenant isolation, untrusted code, AI access, identity, and recovery.",1790019415367]