Security and audit

What a token can never do#

• More than the person who created it. Scopes narrow a person’s permissions and never add to them.
• Read pay. No scope reaches a salary and no endpoint selects a compensation record.
• Outlive the person’s access. Permissions are checked on every call, so removing someone disables their tokens immediately.
• Reach another workspace. Every query is scoped to the token’s workspace, and other workspaces’ ids answer 404.

Audit trail#

Every call is recorded with the token, the operation, the scope and the outcome — allowed, failed, or refused for scope, permission or rate. The record holds ids, never contents.

Reporting a vulnerability#

Email hello@atrix.dev with “security” in the subject. Please tell us before publishing, and give us a way to reach you.