Security Model & Trust Boundaries

Security Architecture

ADCG's security model is built on isolation, verification, and zero implicit trust. Every component assumes it could be talking to a compromised peer.

DMZ-Only Intake

All external submissions enter through the DMZ zone. There is no alternative path:

• No direct API to inject code into the generation pipeline
• No "fast path" that skips DMZ scanning
• Rejected submissions are logged with evidence (intake scan failures are auditable)

Multi-Tenant Row-Level Security

Tenant isolation is enforced at the PostgreSQL level:

• Every table containing tenant data has an RLS policy
• The tenant_id is set from the authenticated session, not from request parameters
• Even application-level bugs cannot leak data across tenants — the database rejects the query

API Authentication

Two authentication mechanisms:

Bearer Token (External)

Authorization: Bearer <api-key>
X-Tenant-ID: <tenant-id>

• API keys are hashed before storage (bcrypt). The plaintext is never stored.
• Keys are scoped to a tenant and a permission set.

HMAC Signing (Service-to-Service)

• Internal services sign requests using shared secrets
• Signature covers: method, path, timestamp, body hash
• Prevents replay attacks (timestamp window: 5 minutes)
• Used for Host/Core ↔ DMZ and Host/Core ↔ DinD communication

Zone Isolation

Boundary	Enforcement
DinD → Host/Core	No network route. DinD containers have no DNS resolution for core services.
DinD → Internet	No outbound NAT. Containers cannot make external requests.
DMZ → Host/Core	One-way message queue only. DMZ cannot query core databases or APIs.
External → Host/Core	API gateway only. No direct database or service access.

Key Hashing

All sensitive credentials are hashed before storage:

• API keys: bcrypt with per-key salt
• Service secrets: HMAC-SHA256
• Evidence hashes: SHA-256 over content + chain

Audit of Security Events

Security-relevant events (authentication failures, RLS violations, policy changes, approval chain completions) are logged to a separate security audit table with the same immutability guarantees as the evidence store.