Skip to main content
VentStream Cloud can change production engine behavior, so every control path is authenticated, authorized, revision-protected, and auditable.

​
Identities

  • Humans authenticate with short-lived built-in or enterprise OIDC tokens.
  • Automation uses explicitly configured OIDC workload providers and scoped service accounts; the current Cloud API does not issue long-lived personal API keys.
  • Engines attach with per-deployment agent keys (vsa1. prefix) minted from the dashboard or CLI. A key is shown once, is revocable, and minting a replacement revokes its predecessor.
  • Agents use deployment-bound X.509 identities over mTLS after the first-connect agent-key handshake. A key re-binds a fresh identity after state loss, and the rotation is recorded as an audit event.
  • A revoked key or unreachable gateway makes the engine exit nonzero at startup; it never falls back to local configuration.
  • Agent private keys remain in the workload environment and are never returned to the control API.

​
Tenant isolation

Authorization is permission-based and scoped to organization or environment. PostgreSQL repositories set tenant context inside transactions and use forced row level security. The runtime database role does not own tables, bypass RLS, or run migrations. A separate one-shot migrator uses a schema-owning role.

​
Operational controls

  • If-Match prevents stale concurrent state changes.
  • Idempotency-Key makes retryable mutations deterministic.
  • Durable operations distinguish accepted, delivered, running, and terminal work.
  • Identity revocation, role changes, lifecycle actions, and configuration changes produce organization-scoped audit events.
  • Agent keys, legacy enrollment tokens, access tokens, private keys, and connector secrets are redacted and excluded from generic replay storage.
VentStream Cloud uses HTTPS, workload mTLS, managed secrets, immutable release artifacts, and monitored audit and operation streams. Customer workloads should keep connector credentials in their own secret manager, restrict inbound exposure, and pin the public engine image (ghcr.io/ventstream/ventstream) by release digest.

​
Built-in account controls

Built-in authentication uses short-lived access tokens, rotating refresh sessions with an absolute lifetime, server-side session revocation, mandatory email verification, distributed login throttling, one-time password recovery, and a multi-key signing keyring with a documented rotation sequence. Password reset increments the account credential generation so previously issued access tokens are rejected immediately. Organizations that require MFA, conditional access, or centralized employee lifecycle policy can configure enterprise OIDC and enforce those controls at their identity provider.