Security review pack

Everything your reviewer needs, on a page, without booking a call. A reviewer who has to schedule a meeting to read a design document has already formed an opinion about the product.

ISOLATION IS A DATA-LAYER PREDICATE, NOT A CHECK IN A PAGERequestany route, any jobSession → contexttenantId · externalOrgId?AsyncLocalStoragenot a threaded parametertenantExtensioninjects the where clauseEvery queryrows · counts · facetsif externalOrgId is present, narrow againShared objects onlydirect ID fetch also failsA parameter can be forgotten at one call site with nothing failing. There is no parameter, so there is nothing to forget.
Isolation is a data-layer predicate, not a check in a page. A parameter can be forgotten at one call site with nothing failing — so there is no parameter.

Isolation

Every tenant-scoped table carries a tenant identifier with an index leading on it. Request and job context lives in async local storage and is read by the database client extension, which narrows every query. Results, totals, facet counts and pagination all derive from one shared clause, so a count cannot reveal the existence of a row a user may not see. External supplier sessions narrow a second time, and a direct fetch of an unshared object by identifier fails — there is a test that attempts it.

Audit

Every write is an attributed audit row, chained by SHA-256 to its predecessor, so a tampered or removed entry breaks verification and the break is locatable. Writes that arrive without an attributed actor are refused rather than recorded as unknown. Administrators have no silent bypass: elevated access is granted explicitly and the grant is itself a row.

Access control

Role-based grants across nine verbs and sixteen resources, with attribute-based rules and field-level access control on top. Search filters at query time rather than partitioning the index, so a permission change takes effect immediately instead of waiting for a re-index — and attribute-level rules do not partition at all, which is the deeper reason for the choice.

AI boundaries

Agents call the same domain services the interface calls and cannot exceed the acting user's permissions. Instruction and data are strictly separated and all object content is treated as untrusted, so a document containing an instruction reaches an agent that has no tool to carry it out. Every agent action is audited with the tier it ran at and the revisions it cited. The permission model is documented in full.

What we do not offer

Logical isolation on shared infrastructure — not single-tenant deployment, not on-premise, not ITAR segregation. Data residency is not yet regionalised. If your programme requires any of those, Manufacturing PLM is the wrong product and we would rather you knew now.