The boundary is in the database, not in the screens in front of it.

Forced Row Level Security

Row Level Security is enabled on every table in the application schema, and on every one of them it is forced. Ordinary Row Level Security protects ordinary roles; FORCE also subjects table owners to policies unless they are superusers or hold BYPASSRLS. Those privileged operator paths can bypass row security, so FORCE alone does not establish their tenant isolation; application security-definer functions instead enforce explicit session and scope checks. A schema trigger applies the setting to new application tables.

Checked in the application too

The application checks the signed-in person’s organization and role as well. That check is the first line; the database boundary is the one that still holds if a query is ever written incorrectly. Ordinary tenant requests use the caller’s database policies; privileged application functions enforce explicit session, organization and role checks.

A cross-tenant link cannot be stored

Relationships carry the organization too — a link from one customer’s work to another’s is declared on the pair of organization and record, so it does not satisfy the constraint and cannot be stored. A cross-tenant reference is a constraint violation, not a bug that behaves like a working join.

Where it is writtenscripts/prove-tenancy.mjsscripts/measure-posture.mjssrc/app/app/[org]/settings/security/page.tsx

The run enumerates what to try from the live schema rather than from a checklist, so anything added to the product is covered by the next release rather than by somebody remembering it. A table added with no organization on it is reported by name instead of being skipped quietly.

The same run attempts the deletions the trail is supposed to refuse, so the append-only boundary is proved by trying to cross it rather than asserted. Workspace security settings show current session and schema reads separately from the historical proof, with its recorded deployment and date.

Historical isolation proof · LockedIn Labs Engineering External hosted service. Recorded 26 August 2026, 50 days ago: the run recorded no readable foreign row or accepted foreign write. This is the record of a run at a moment, not a live check. The proof does not verify Agentic Engineering Platform production or this installation. Schema measurement · LockedIn Labs Engineering hosted service. Measured on 4 October 2026, 11 days ago, with read-only queries against the production database catalogue. At that measurement, every application table had Row Level Security enabled and forced; no policy was unconditional and no table lacked a policy; the unauthenticated role held no privilege in the application schema; every view ran with the privileges of its caller; every function that runs as its owner pinned its search path; cross-organization references were declared as organization-and-record pairs. This account is built from that measurement rather than from a live query.

Where it is writtenscripts/prove-tenancy.mjsscripts/gate.mjs

A token a person can revoke

A terminal token belongs to one person. It is shown once when it is minted and stored only as a digest, it expires, and its owner can revoke it from the workspace’s member settings. It stops working when it is revoked or expires, when its person leaves the workspace or is demoted, and for a project outside what it may reach. Minting one needs the second factor the account or organization requires.

No provider key on a laptop

On the gateway path the provider key never leaves the platform. The workspace records where a key lives and the gateway reaches it for the call; a person points Claude and Codex at the gateway address with their own token, and nothing else.

Content is classified first

Each request is classified on the server from the exact text that would be sent: internal content, personal identifiers, health identifiers, or a secret. A connection is used only for the classes it was approved for, and a request that carries a secret is refused before any model connection is opened.

Egress is checked before connecting

An approved provider is still refused when its endpoint falls outside the workspace’s network policy: the address is checked before a connection is opened.

Spend is reserved first

The remaining model budget is reserved before the call is made and settled when the call finishes.

Where it is writtensrc/lib/ai/gateway.tssrc/lib/ai/classification.tssrc/lib/integrations/egress.tssupabase/migrations/20261018500000_model_gateway_workspace_optin.sqlsupabase/migrations/20261018520000_terminal_propose_authority.sql

The catalog is derived, not typed

What an agent can call comes from the server that publishes the tools, so the register cannot describe a door that does not exist or miss one that does.

Writes are denied by default

A tool that only reads is available. Anything that writes is refused until somebody with authority grants it, and the basis they gave is recorded beside the grant — a register whose default is “allowed” is a list rather than a control.

The check precedes the door

The permission is asked at the workspace endpoint before the tool executes, never alongside it — a check that runs in parallel with the work it authorizes has authorized nothing. The answer comes from the same function the workspace console reads, so the screen cannot describe a posture the door does not apply.

A refusal is a record

It names the tool, the reason, and whether the call was stopped or only watched, because a control a workspace deliberately made advisory is not a control it is protected by. It never names the payload, and the stated reason is screened at write against the patterns that identify a person, so a refusal cannot itself become the leak.

Agents build inside your boundary

Delegate a work item to a registered agent. A runner you enrol on your own machine runs it with credentials that never leave that machine, tests the change with your repository's suite and has a second agent review it. The hosted service holds no model key for the run and never merges.

A person decides what ships

Acceptance checks the project rules, unresolved questions and required independent review. The requester cannot decide their own proposal, even with an approval role.

Operating policies

A policy states what a run may not do: widen its own permissions, pipe fetched bytes straight into an interpreter, carry regulated content past its approved boundary, or accept its own output. Each is adopted by a named person at a stated enforcement level, and which are blocking is recorded rather than assumed.

Silence is never a pass

A policy with no verdict on a run reads as not evaluated — never as passed. Verdicts are append-only, and a waiver that names nobody is refused by the database. Correcting a verdict means recording a new run, which is the honest shape.

Where it is writtensupabase/migrations/20260820190000_tool_permission.sqlsrc/app/api/mcp/route.tssrc/lib/tool-permission/gate.tssupabase/migrations/20260820020000_agentic_harness.sql

On premises

Runs on hardware this organization controls. Prompts do not leave the network.

Private cloud

A tenant-isolated deployment under contract. Handling is governed by that agreement rather than public terms.

Vendor hosted

A public API. Work sent here leaves the organization's boundary.

The posture is the permission

Work that carries regulated content is not sent to a model approved for de-identified work only, and the decision was made by a named person in advance rather than by whoever configured the run.

Several credentials, each bounded

A workspace holds several credentials at once, each with its own boundary and its own ceiling, and a retired one stays listed with the date and the person, because the runs that happened under it did happen.

No key on a register a member can read

The pointer to the key and the key’s fingerprint are withheld from every workspace role, and the runtime reaches the secret through a privileged function that hands it to nobody. The register never holds a key — only where one lives, in words — and key-shaped text is refused at write by the database, not by a form.

Where it is writtensupabase/migrations/20260820100000_provider_credentials.sqlsupabase/migrations/20260820200000_ai_credential_repair.sqlsrc/lib/harness/model.ts

In transit

Every connection — browser to application, application to database — is TLS 1.2 or above. There is no unencrypted listener to reach.

At rest

The database and its backups are stored encrypted with AES-256 on managed infrastructure.

Where it sits

The application database and its backups are stored in the United States; application servers also run there. Public pages are cached globally. Data sent to an approved model, email service or optional voice assistant is processed under that provider’s arrangements, described below under subprocessors and models and egress.

Regions, key management and the limits of what we will put in a contract are set out in control detail.

Least privilege is the default

There is no cross-organization role and no global search. Least privilege here is the default state rather than a setting somebody has to remember to switch on.

Two kinds of authority, kept apart

Administering a workspace and holding authority over delivery evidence are deliberately different grades, so managing membership does not carry the power to publish evidence, change billing or transfer ownership.

Two-step verification

Any member can enroll a time-based code from an authenticator app. Once enrolled it cannot be skipped, and enrollment issues single-use recovery codes that are shown once and never emailed. No support process here can remove somebody’s second factor on request.

Passwords are never ours to lose

Passwords are kept by the identity service alone. This application never stores or logs a password or a verification code; when you set or change a password it is passed straight through to that service. New passwords must be at least twelve characters, with a lower-case letter, an upper-case letter and a digit, and are checked against the Have I Been Pwned breach corpus and refused if they appear there.

Sessions expire, and privileged acts re-ask

A session ends after eight hours idle or twelve hours in total, and ending it revokes it at the identity service rather than only clearing the browser. Changing how people sign in to a workspace requires proving your identity again within the last fifteen minutes, and removing your own second factor requires that factor or an unspent recovery code.

An act is somebody's act

Custody triggers take the actor from the authenticated session rather than from anything the client sends, and a session with no identity behind it cannot approve a model, adopt a policy or grant a tool at all — the database refuses the write and says why.

Single sign-on

SAML 2.0 for Microsoft Entra ID and other standards-based providers is built into the product and enabled per deployment during onboarding. Its current activation status is stated in control detail.

The actor comes from the authenticated session rather than from anything the client sends. Deletion is blocked for workspace users, for owners and for privileged platform roles, and each release proves that boundary by attempting the deletion and being refused. The trail is kept for the life of the tenancy. It does not roll off on a schedule and it is not something a plan can buy more of.

Evidence that leaves the building

Delivery evidence leaves the workspace as a receipt: an Ed25519 signature over canonical bytes, holding the counts with their denominators, the acceptances, and the commit the export was pinned to. Anyone holding it can check it in their own browser at /verify — no account, and no verification endpoint — or with their own code, because the format and the canonicalization are published.

A receipt carries its own public key, so a signature alone proves only that some key signed it. /verify attributes a receipt to Agentic Engineering Platform only when its signing key is one this deployment publishes, and the same list is published at /.well-known/receipt-keys.json for anyone who wants to pin it.

A claim whose count exceeds its own denominator is not rounded: the receipt is not issued. There is no partial receipt.

Where it is writtensrc/lib/evidence/receipt.tssrc/lib/evidence/canonical.tssrc/lib/evidence/issuer.tssrc/lib/evidence/receipt-keys.tssrc/app/verify/page.tsx

Backups

Daily encrypted database backups are managed by Supabase. Point-in-time recovery is not enabled on this deployment. These backups include stored file metadata, but not the file contents held in Storage.

Dependency posture

Dependency advisories are triaged for reachability, and the tests that establish an advisory is unreachable are kept so the classification can be re-checked rather than believed.

Recovery objectives and support commitments are commercial terms, settled in the agreement for the estate in question. What this deployment does and does not commit to today is stated in control detail.

Supabase

The database, authentication identities and file storage.

Netlify

Request metadata, and the rendered HTML of every page.

Resend

The email address of anyone invited to a workspace.

Stripe

Billing contact and payment details for a paid plan. Card numbers are entered on Stripe’s own page and never reach this application.

Google Gemini (optional voice assistant)

Only when the assistant is enabled: a workspace brief scoped to what the signed-in person may already read — the workspace name, selected project keys, titles and states, and aggregate register counts — plus the live conversation’s audio and transcriptions. It receives nothing from this application when the assistant is not enabled.

A model a workspace approves under models and egress is not on this list: those are the customer’s own arrangements, made under the customer’s own contracts, and the register records where each one runs so that the answer belongs to them rather than to us.

A data processing agreement, standard contractual clauses, a business associate agreement (BAA) where one is needed, incident-notification terms and deletion undertakings are settled in the enterprise agreement.

Agentic Engineering Platform holds no third-party attestation today. SOC 2 Type II, HITRUST and FedRAMP authorization are not held, and neither is ISO/IEC 27001. The product is not PCI DSS assessed and stores no card data — card details are entered on Stripe’s own page and never reach this application. We publish that here rather than in a footnote, because a trust badge that turns out to be a roadmap is the thing a reviewer never forgives.

The controls above describe their mechanisms and dated measurements. Source references identify the implementations for technical review; control detail answers common questionnaire topics. Nothing the platform produces is described as certified.

Every claim on this page describes a mechanism that exists today, and the files under each section are where it is written.