Security and data boundaries
Make every document boundary explicit.
Understand where bytes enter, which runtime executes an operation, what leaves the boundary, and which evidence can be retained by policy.
surface selected by capabilityHow this surface works
Security claims should resolve to an execution and retention boundary you can inspect.
Scoped input
The caller supplies the artifact and operation inside an explicit tenant and runtime context.
Bounded execution
Registered operations apply declared budgets, cancellation, and typed failure semantics.
Controlled result
Artifacts, diagnostics, and evidence leave or persist according to the selected surface.
Operational sequence
State advances only with evidence.
Every step has an observable input, result, and release consequence.
- 01
Choose the execution surface
Match local or managed capability to the data and operational boundary required.
boundary - 02
Invoke with scoped context
Keep operation, tenant, cancellation, and loss policy explicit.
execute - 03
Apply retention policy
Retain only the artifact and evidence state the selected product surface supports.
retain
Availability
Claims follow the registry.
Security and deployment claims follow the currently available surface; future private deployment is not represented as shipped.
Inspect current capability evidence