Security architecture · documented controls

AI agent security for controlling actions before they reach your systems.

Createting’s security model is built around tenant boundaries, scoped agent identity, pre-execution policy decisions, approval binding and evidence. This page describes mechanisms present in the current architecture—and states where validation or production hardening is still environment-dependent.

Inspect agent governance →Assess a workflow
Current code-backed mechanisms≠ certification claim

Pre-execution boundary

An action is described before authority is decided.

Runtime actions can carry the action type, target resource, arguments, side-effect state, external/sensitive flags, risk hints, expected effect, data-access summary and target system. The policy gate then returns an explicit decision rather than treating every tool invocation as equivalent.

ACTION DESCRIPTORconfigured example
action
crm.update_account
effect
external write
risk
high restriction
decision
ASK
binding
approval fingerprint
Describe→Classify→Policy→Approve / deny→Execute

Security controls

Separate controls for identity, data boundary, execution and evidence.

01

Tenant context and workspace boundaries

The current Arch2 data plane includes tenant context checks, membership validation and an RLS coverage audit for tenant-scoped tables. The audit can detect missing RLS, missing forced RLS and missing canonical tenant policy instead of assuming isolation is complete.

implemented mechanism
02

Agent identity and delegated work

The architecture includes an agent-identity layer with JWT, DPoP and delegation primitives. Delegated system-agent work is designed to retain an attributable identity rather than collapsing every action into one anonymous backend actor.

implemented foundation
03

Action-level authority

The shared ActionPolicyGate covers tool, knowledge, web search, memory write, browser, computer, external API, subagent and artifact actions. Decisions can allow, request approval, deny or hard-deny based on capability state, autonomy and risk.

Deep dive →
04

Approval is tied to a recorded action request

Approval snapshots are fingerprinted from the action descriptor. A resumed approval can therefore be checked against the prepared action instead of silently authorizing a different replanned request.

decision binding
05

Sandboxed and environment-bound execution

The architecture contains persistent workspaces, sandboxed execution, snapshots and staging promotion. Browser and computer sessions are modeled as agent-bound runtime capabilities with recovery, cleanup and environment trace events.

Browser boundary →
06

Durable state and evidence

Durable execution, typed state, checkpoint write-through, execution traces and a compliance ledger provide mechanisms for retaining operational context and evidence. Retention and legal-hold behavior still depend on the configured deployment and policy.

evidence layer

What this does not claim

Architecture controls are not the same thing as external assurance.

No certification shortcut.

This page does not claim SOC 2, ISO certification, GDPR compliance or another external certification solely because technical controls exist.

No universal production-ready claim.

Current architecture documentation still marks parts of environment operations and governed runtime hardening as in progress or production-hardening open.

No environment-free security claim.

Secrets, provider configuration, deployment topology, identity provider setup, network policy and operational procedures affect the real security posture.

No “zero-risk” language.

Governance reduces and constrains risk; it does not make autonomous execution infallible.

Current architecture status

Implementation status is part of the security story.

AreaCurrent repository statusBuyer interpretation
Tenant isolation / RLS auditImplementedMechanism exists; deployment audit still matters.
Agent identityImplemented foundationIdentity/delegation primitives exist.
Sandbox workspaceImplementedSandbox, snapshots and staging mechanisms exist.
Browser / computer environmentsRuntime slice in progressValidate provider and environment behavior for the target deployment.
Governed runtime decision bindingDEV_READY; production hardening openDo not treat development readiness as external assurance.

Evaluate the boundary

Start with one consequential workflow.

Map the systems it touches, the writes it can perform, the approval owner and the evidence required after execution.

Explore the agent platform →
Assess the workflow →Request an Architecture Review