docs: resolve tenant security audit

2026-07-10 03:05:58 +08:00
parent 5e412761d2
commit 682bc70563
11 changed files with 368 additions and 2 deletions
@@ -1,7 +1,7 @@
 # Audit tenant, authentication, and request security boundaries

 Type: research
-Status: open
+Status: resolved

 ## Question

@@ -10,3 +10,31 @@ Organization boundary, bypass the intended platform/org/project authorization
 seams, expose secrets, or accept unbounded hostile input in the initial
 production topology?

+## Answer
+
+Yes. Basic org-admin HTTP/Prisma scoping is correctly enforced and its 28
+targeted integration tests pass, but the agent inherits service secrets and can
+read sibling files, MCP file/context tools accept real targets outside the run
+objects, queued/card actions do not consistently bind or reauthorize their
+target, non-ACTIVE tenants can still trigger agents, and Feishu/provider
+credentials remain global instead of ADR-0021 org-scoped encrypted secrets.
+Current Node and Rust dependency audits also fail on high/vulnerability/unsound
+advisories.
+
+The complete contract mapping, reproductions, positive evidence, advisory
+inventory, and required release proofs are in the
+[tenant, authentication, and request security audit](../assets/tenant-auth-security-audit.md).
+
+The newly-clear implementation and decision frontier is:
+
+- [Confine the agent runtime and protect service credentials](16-confine-agent-and-protect-credentials.md)
+- [Close MCP context and file-delivery escape paths](17-close-mcp-data-egress-escapes.md)
+- [Bind and reauthorize deferred and card actions](18-bind-and-reauthorize-deferred-actions.md)
+- [Design the org-scoped secret and connection control plane](19-design-org-scoped-secret-control-plane.md)
+- [Design the production browser and session boundary](20-design-production-web-session-boundary.md)
+- [Clear dependency advisories and gate releases](21-clear-dependency-security-advisories.md)
+- [Enforce Organization status at the shared authorization seam](22-enforce-organization-status.md)
+
+Inbound Feishu file count/size/MIME and request-rate policy remain owned by
+[Define initial abuse and capacity controls](05-define-abuse-capacity-controls.md)
+rather than being guessed in this audit.