READMEEN
Security & RBAC
This directory documents the varwof-core permission security model and its authorization verification results for security audits and compliance.
Index
| Document | Description |
|---|---|
| RBAC Security Model (cert-first) | Trusted authority, non-cert credential limits, management sub-CA gate, CA scopes, route fail-closed, role matrix, audit guide |
| RBAC Verification Report 2026-08-28 | Full measured matrix (378×2 checks) across simple/enterprise modes plus P0 probes and reproduction steps |
| Deployment Hardening | Pre-flight/maintenance checklist: authorization, TLS, keys, limits, audit, ops |
| Private Key Hygiene | Key classes, permissions, the cert-vs-key trap, at-rest encryption, rotation, backup, anti-pattern checklist |
| Threat Model & Risk Register | Assets, trust boundaries, attack surface; R-ID register of fixed/accepted risks; STRIDE mapping |
| Audit Logging & Compliance | Audit model & queries, Merkle chain integrity, PII masking, SOC2/PCI/NIST/ISO evidence |
Reading path
- Start with the security model: the three authority rules — superadmin is certificate-only, accounts are always operator, management sub-CA is hard-excluded for non-superadmin.
- Then the verification report: measured HTTP codes for the 378×2 matrix and the P0 probes.
- To change permissions, edit
routes.jsonandinternal/serve/routes_default.json(keep them in sync) and runscripts/verify-rbac-api.sh.