Security Model

Security Model

The idea in one paragraph

IGL is security infrastructure, so it is held to the standard it asks of others: say what is enforced, say where, say what is not yet, and make all of it checkable from outside. This page is the honest map. The platform's guarantees are enforced at the edge on every request and proven with receipts and chains. The runtime has had a security review (a technical review, not a certification or a penetration test); all nine findings are fixed with regression tests, and the scripts that reproduced them are kept in the repository so anyone can watch the properties hold.

What is enforced, and where

Guarantee	Platform (api.id-me.ai)	Runtime (your machine)
Every caller is identified	Keys and tokens are bound to an identity and a tenant; X-IGL-Tenant-Id must match the credential or the request is refused before anything else	A statement without ID[...] does not parse
Actions are bounded	Scopes on the credential, purpose profiles on reads, policy evaluation on actions; deny beats everything; no matching policy means deny	Grant lattice checked statically and at run time; the decode bridge masks model output to the boundary
Intent is recorded	Purpose on every projection, outcome on every interaction	Intent[...] on every statement
The record cannot be quietly changed	Per-tenant hash chain with database triggers that refuse updates and deletes; Ed25519 receipts with a published key	File backed hash chain that refuses to load if altered; Merkle proofs; receipts carry the runtime digest
A model's word is not authority	proposed records never appear in projections or become authority; intelligence answers must cite records or fail with 422	observed: proposed can never be promoted; the weakest link in a trace governs
Nothing files without a human	human_approval workflow steps; escalate parks a run	IOS.Attest with a registered signer's approval as an input; three attestation classes

Credentials

API keys are random, shown once, stored as a SHA-256 hash with a 12-character display prefix, and bound to a tenant and an identity. Scopes are igl.read, igl.write, igl.execute, igl.admin, and igl.platform for the one key that administers tenants. Keys can be exchanged at auth.id-me.ai/oauth2/token for EdDSA tokens with narrower scope and a one-hour life. Any key can be revoked with POST /admin/keys/revoke; a revoked key is refused on the next request, and a token minted from a revoked key is refused too. The platform key is rotated by revoking it and running bootstrap again.

Rate limits are per key: a bucket of 120 refilled at 2 per second on production, 60 at 1 per second on the sandbox, where a read costs 1, a write 5 and an MCP call 2. Sandbox signup is rate limited by address. Bodies over 1 MB are refused. CORS is an allow-list (id-me.ai and www.id-me.ai), never a wildcard.

The operator console

The console is the one surface with a human sign-in. The password is a Worker secret, never stored in code or configuration files; sessions are signed, HttpOnly, SameSite=Strict cookies; lockouts are kept in shared storage so they hold across instances; and the Worker refuses every request with 503 if neither the built-in sign-in nor Cloudflare Access is configured. Its content security policy allows nothing external. It writes to one table (inquiry status and notes) and reads everything else.

Supply chain

The actions that check out code, set up Node, deploy and publish releases are pinned to commit hashes; Dependabot keeps every action and the npm dependencies current, Dependency Review runs on pull requests, CodeQL scans on every push, and the OpenSSF Scorecard runs weekly and publishes its results. Release tags are signed and the npm package is published with provenance when it is published. The runtime has one production dependency (@huggingface/transformers) with overrides pinning its transitive packages past known advisories; npm audit --omit=dev --audit-level=high runs in CI.

The review, in the open

The October 2026 security review of the runtime and provisioning service is in the repository at docs/audit/SECURITY-AUDIT-2026-10.md. It found nine issues. Four were high severity in the provisioning service and were fixed in 1.3.0 with a regression suite: the service running open by default (F-01), caller recognition not used for authorization (F-02), grants created from untrusted descriptions (F-03), and attestation not establishing human approval (F-04). Five were in the runtime and were fixed in 1.5.0, each with a regression test in test/audit.test.js: the idempotency key is now a SHA-256 execution identity over every material input (F-05); journal records are frozen snapshots and reuse is its own journal event, so a record never changes after it is written (F-06); nothing is visible until it is durable, and a failed flush rolls back (F-07); checkpoints detect a truncated or rewritten chain, and a signed head receipt serves as one (F-08); Traces=None returns nothing and every refusal is journaled as a failure event (F-09). The review also asked for model provenance, and the provisioning service now loads its model at a pinned revision and records the digest of the bytes in every inference. The probe scripts that reproduced the findings ship in docs/audit/ and now print the properties holding. What the review could not provide is independence: it was written by the project. The README describes the status that way until a third party has looked.

The hosted platform is a separate implementation (Cloudflare Worker and D1) and does not share the runtime's journal code; its chain, receipts and triggers are covered by the conformance suite that runs on every deploy.

Reporting a problem

Do not open a public issue for a vulnerability. Use GitHub private vulnerability reporting or write to security@id-me.ai. Acknowledgment within 48 hours, severity within five business days, coordinated disclosure with a 90-day target, and credit in the advisory unless you prefer anonymity. Anything that breaks one of the four guarantees is treated as critical.

What we ask of you

Keep keys out of chat, tickets and screenshots. Use the sandbox until you have read the explain output for your own purposes. Verify at least one receipt yourself; it takes a minute, and after that you are not taking our word for anything.