Skip to main content
VentStream Cloud can change production engine behavior, so every control path is authenticated, authorized, revision-protected, and auditable.

​
Identities

  • Humans authenticate with short-lived built-in or enterprise OIDC tokens.
  • Automation uses explicitly configured OIDC workload providers and scoped service accounts; the current Cloud API does not issue long-lived personal API keys.
  • Agents use deployment-bound X.509 identities over mTLS after one-time enrollment.
  • Agent private keys remain in the workload environment and are never returned to the control API.

​
Tenant isolation

Authorization is permission-based and scoped to organization or environment. PostgreSQL repositories set tenant context inside transactions and use forced row level security. The runtime database role does not own tables, bypass RLS, or run migrations. A separate one-shot migrator uses a schema-owning role.

​
Operational controls

  • If-Match prevents stale concurrent state changes.
  • Idempotency-Key makes retryable mutations deterministic.
  • Durable operations distinguish accepted, delivered, running, and terminal work.
  • Identity revocation, role changes, lifecycle actions, and configuration changes produce organization-scoped audit events.
  • Enrollment tokens, access tokens, private keys, and connector secrets are redacted and excluded from generic replay storage.
VentStream Cloud uses HTTPS, workload mTLS, managed secrets, immutable release artifacts, and monitored audit and operation streams. Customer workloads should keep connector credentials in their own secret manager, restrict inbound exposure, and use the image digest supplied by the Cloud installation profile.

​
Built-in account controls

Built-in authentication uses short-lived access tokens, rotating refresh sessions with an absolute lifetime, server-side session revocation, mandatory email verification, distributed login throttling, one-time password recovery, and a multi-key signing keyring with a documented rotation sequence. Password reset increments the account credential generation so previously issued access tokens are rejected immediately. Organizations that require MFA, conditional access, or centralized employee lifecycle policy can configure enterprise OIDC and enforce those controls at their identity provider.