Surfaced by the Security Model spine doc's gap register (docs/learn/spine/the-security-model.md).
Gap (4C: cross-cutting). The defense-in-depth model isn't adversarially validated — controls are asserted, not empirically tested.
Do: establish periodic pentest / red-team exercises against the platform + a sample tenant; feed findings back into the gap register.
Surfaced by the Security Model spine doc's gap register (
docs/learn/spine/the-security-model.md).Gap (4C: cross-cutting). The defense-in-depth model isn't adversarially validated — controls are asserted, not empirically tested.
Do: establish periodic pentest / red-team exercises against the platform + a sample tenant; feed findings back into the gap register.