# Security model

Apply Authlane tenant, browser, credential, OAuth, and provider-execution boundaries.

Authlane is a credential and capability control plane. Your SaaS remains the identity authority and
provider execution boundary.

## Prerequisites

Threat-model a PostgreSQL leak separately from runtime compromise, use external versioned keyrings,
and issue least-privilege server keys per workload.

## Implement the workflow

- Resolve `organizationId` only from the authenticated principal and enforce PostgreSQL RLS with a
  non-owner runtime role.
- Derive `externalUserId` only from the authenticated SaaS session, then bind
  `authlane.user(externalUserId)`.
- Create short-lived connect sessions with an exact HTTPS origin and concrete service snapshot.
- Encrypt secret records with per-record AES-256-GCM DEKs wrapped by a versioned deployment KEK.
- Issue fresh, audited, access-only leases just in time; retain them only for one provider call.
- Use PKCE and cryptographically random, single-use OAuth state.
- Rate-limit public endpoints and log safe request metadata without credentials or provider bodies.

## Expected result

A database-only leak does not expose directly reusable plaintext credentials. Browser compromise
does not reveal tenant API keys or provider secrets. Listing status or definitions issues no lease.

## Handle errors

Return stable redacted codes to applications and models. Never forward provider response bodies,
credential material, OAuth codes, stack traces, or caught secret-bearing messages.

## Security boundary

Never serialize executable toolsets or MCP servers, cache them across users, or trust an external
user ID from a URL, browser body, prompt, or tool argument. Provider traffic goes directly from the
SaaS runtime to the provider; Authlane is not a gateway.

## Next step

Apply [production hardening](/docs/guides/production-hardening), then complete the
[security operations](/docs/guides/security-operations) launch gate.