Security and access

This section describes the Core boundaries for local operator access, service secret metadata, audit history, and isolation. It does not claim service-specific security behavior or capability maturity beyond the cited canonical records.

• Vault setup and key custody describes the supported first-run custody and recovery boundary.

• Users and permissions defines local and remote first-run access rules.

• Service secret access defines assignment and policy metadata without exposing secret values.

• Audit history describes durable metadata-only evidence.

• Process and resource isolation defines the supported isolation ladder and honest degradation rules.

• Service environment isolation explains custom env blocks, Windows process access, and Linux procfs hardening, including the same-UID limits of hidepid.

• Supported capabilities and limitations is the runtime capability API contract. Consult the capability ledger for maturity and release-readiness evidence.

• Operate and recover Secrets Broker centralizes bounded setup, recovery, source and adapter tasks with exact source provenance.