Authorization Model

Principals

Human user via OIDC session.
Application service account via bearer token.
Internal worker identity.

Rollen

platform_admin, workspace_admin, space_manager, editor, viewer, auditor.

Application scopes

Voorbeelden: search, context, answer, documents:read, citations:read, feedback:write, sources:sync.

Effective-space algorithm

effective = requested spaces
          ∩ explicit grants for principal/application
          ∩ active spaces in the same workspace
          ∩ spaces compatible with operation and provider policy

Een lege requested set betekent alleen de configured defaults van de application, nooit alle grants. Filters worden door de server samengesteld en kunnen niet via raw Qdrantfilterinput worden overschreven.

Defence in depth

Use-case authorization vóór repository calls.
Workspace-gebonden databasequeries en waar passend PostgreSQL RLS.
Verplichte Qdrant payloadfilters.
Citation/documentread voert opnieuw resourceauthorization uit.
Securitytests proberen IDOR, filterinjectie, inactive records en cross-space leakage.

1.1 KiB Raw Blame History