Security model

Authlane is a credential and capability control plane. Your SaaS remains the identity authority and provider execution boundary.

Prerequisites

Threat-model a PostgreSQL leak separately from runtime compromise, use external versioned keyrings, and issue least-privilege server keys per workload.

Implement the workflow

• Resolve organizationId only from the authenticated principal and enforce PostgreSQL RLS with a non-owner runtime role.
• Derive externalUserId only from the authenticated SaaS session, then bind authlane.user(externalUserId).
• Create short-lived connect sessions with an exact HTTPS origin and concrete service snapshot.
• Encrypt secret records with per-record AES-256-GCM DEKs wrapped by a versioned deployment KEK.
• Issue fresh, audited, access-only leases just in time; retain them only for one provider call.
• Use PKCE and cryptographically random, single-use OAuth state.
• Rate-limit public endpoints and log safe request metadata without credentials or provider bodies.

Expected result

A database-only leak does not expose directly reusable plaintext credentials. Browser compromise does not reveal tenant API keys or provider secrets. Listing status or definitions issues no lease.

Handle errors

Return stable redacted codes to applications and models. Never forward provider response bodies, credential material, OAuth codes, stack traces, or caught secret-bearing messages.

Security boundary

Never serialize executable toolsets or MCP servers, cache them across users, or trust an external user ID from a URL, browser body, prompt, or tool argument. Provider traffic goes directly from the SaaS runtime to the provider; Authlane is not a gateway.

Next step

Apply production hardening, then complete the security operations launch gate.