Workspace isolation
The authenticated session resolves workspace context. Inventory requests use tenant-scoped keys and a restricted PostgreSQL inventory role with row-level security. RLS is an additional defense, not authentication and not protection against a compromised database administrator. Account/security tables also require explicit authorized predicates.
Roles and actions
| Role | Reconciliation access |
|---|---|
| Owner | Inspect, decide and reverse; manage workspace connections, membership and credentials. |
| Editor | Inspect, decide and reverse through authorized inventory workflows. |
| Viewer | Inspect evidence and history; cannot submit decision or reverse commands. |
Credential boundary
Provider credentials are stored separately using the hosted application’s encrypted credential mechanism. Matching reads allowlisted metadata from an authorized snapshot, not ciphertext or arbitrary provider configuration. Credential rotation is an explicit owner operation, and duplicate connection creation must not rotate a secret. See the security and trust guide for the supported protections and limits.
Untrusted provider text
Source names, descriptions and evidence are external data. The application renders provider text as text, never executable HTML. A prompt or instruction inside a source description has no authority to link records, change ownership or authorize a command. Do not copy prompts, conversations or credentials into matching rules.
What this does not secure
CatProof records governance decisions. It does not block runtime tool calls, prove compliance, independently verify vendor reference semantics, or revoke provider credentials when a local connection is removed. Revoke provider access at the provider when required. No certification or immutable audit-store claim is implied.