> ## Documentation Index
> Fetch the complete documentation index at: https://ventstream.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud security model

> Identity, tenant isolation, certificate, and operational controls for VentStream Cloud.

VentStream Cloud can change production engine behavior, so every control path is
authenticated, authorized, revision-protected, and auditable.

## Identities

* Humans authenticate with short-lived built-in or enterprise OIDC tokens.
* Automation uses explicitly configured OIDC workload providers and scoped service
  accounts; the current Cloud API does not issue long-lived personal API keys.
* Agents use deployment-bound X.509 identities over mTLS after one-time enrollment.
* Agent private keys remain in the workload environment and are never returned to
  the control API.

## Tenant isolation

Authorization is permission-based and scoped to organization or environment.
PostgreSQL repositories set tenant context inside transactions and use forced row
level security. The runtime database role does not own tables, bypass RLS, or run
migrations. A separate one-shot migrator uses a schema-owning role.

## Operational controls

* `If-Match` prevents stale concurrent state changes.
* `Idempotency-Key` makes retryable mutations deterministic.
* Durable operations distinguish accepted, delivered, running, and terminal work.
* Identity revocation, role changes, lifecycle actions, and configuration changes
  produce organization-scoped audit events.
* Enrollment tokens, access tokens, private keys, and connector secrets are
  redacted and excluded from generic replay storage.

VentStream Cloud uses HTTPS, workload mTLS, managed secrets, immutable release
artifacts, and monitored audit and operation streams. Customer workloads should
keep connector credentials in their own secret manager, restrict inbound
exposure, and use the image digest supplied by the Cloud installation profile.

## Built-in account controls

Built-in authentication uses short-lived access tokens, rotating refresh sessions
with an absolute lifetime, server-side session revocation, mandatory email
verification, distributed login throttling, one-time password recovery, and a
multi-key signing keyring with a documented rotation sequence. Password reset
increments the account credential generation so previously issued access tokens
are rejected immediately.

Organizations that require MFA, conditional access, or centralized employee
lifecycle policy can configure enterprise OIDC and enforce those controls at
their identity provider.