Security & governance

Fleet governance, not just observability.

Permissions by owner and group, encryption by design, immutable audit and operational practices to keep a fleet healthy. This page describes Kordana's product controls; it does not replace formal assessments or certifications.

01·Every object has a human owner

The chain of responsibility is part of the data model.

Unit

A named human owner for every agent. There is no unit without an accountable person.

Group

Every node in the tree — domain, customer, process — has a human owner.

Policy

Budgets and rules inherit down the tree; the most specific policy wins and restrictions never relax.

02·Permission model

Roles with explicit scope, inherited through the group tree.

Permissions operate on units and groups, not on screens. A supervisor for one group cannot touch units in another; an auditor reads everything but executes nothing. Role changes are audited events.

Role	Scope	Can
Unit owner	Unit	Edit the role, adjust limits, approve escalations, retire the unit.
Group owner	Group and descendants	Approve onboarding, move units between groups, set budgets, order a freeze.
Operational supervisor	Assigned group	Stop / play, take cases from the inbox, execute handoff, open incidents.
Auditor	Full read	Query the immutable log, export reports, verify retirement certificates.
Platform administrator	Tenant	Manage SSO, roles, connectors and global policies. No access to operational data.

Enterprise SSO and SCIM provisioning planned for tenants with centralized identity requirements. Check availability on your plan.

03·Identity and access

Its own non-human identity per unit.

Never a borrowed human credential. Each unit gets its NHI with a rotation date. The access profile is registered structurally in Design — system, permission, justification, approver — and used as the contract for provisioning and revocation.

· Provisioning against a profile approved by the owners of the accessed systems.
· Versioned credential rotation per unit.
· Automatic revocation verified against the source profile.

Retirement certificate

Verified retirement

No certificate, no retirement. The phase that eliminates zombie agents.

Credentials revoked✓
Access closed✓
Orphan work = 0✓
Full archive✓

Target: 100% of units retired with a certificate. Live credentials post-retirement: 0.

04·Encryption by design

Data protected in transit, at rest, and in the vault.

Kordana doesn't ask you to take our word for it: the cryptographic controls are part of the product architecture. This description reflects the service implementation and is not an independent certification.

In transit

TLS 1.2+ between browser, APIs, connectors and integrated frameworks. HSTS enabled on the domain.

At rest

AES-256 encryption managed by the infrastructure provider. Volumes, snapshots and backups included.

Secrets and NHI

Unit credentials and connector tokens live in a dedicated vault, with versioned rotation per unit.

Tenant isolation

Logical data segregation per organization and row-level access controls for owners and groups.

05·Immutable audit

Actor, action, object, timestamp, justification.

Every control action is written to the log, no exceptions — including those taken by automated policies.

Timestamp	Actor	Action	Object	Justification
10:42:03	Ana Pérez · Supervisor	STOP	unit/collections-latam-07	Spend threshold exceeded
10:44:11	Policy · budget-latam	DEGRADE	group/collections-latam	Daily budget at 95%
11:02:37	Ana Pérez · Supervisor	APPROVE	case/esc-8821	Context verified with customer

06·Operational best practices

Six rules to keep the fleet from getting away from you.

Practices we recommend to teams operating agents in Kordana. They align with the data model and the product's levers.

Least privilege by default

Every unit starts with the narrowest possible access profile. Expanding it requires the owner of the accessed system to approve.

Conservative limits at onboarding

Budget, hours and action caps default to conservative during probation. They relax once the unit graduates.

Freeze before hotfix

When in doubt, pause the unit or the group. A freeze costs less than a deviation in flight.

Quarterly access review

Revalidate owners, live credentials and profiles against connected systems. Scheduled NHI rotation.

Postmortem per formal incident

Every incident closes with findings linked to the unit and the next role version.

Retirement with a certificate, always

Without a retirement certificate there is no closure. The only way to eliminate zombie agents at scale.

Anti-pattern we eliminate

Zombie agent

A unit informally retired that keeps live credentials or access. Phase 6 — verified retirement with a certificate — is exactly what eliminates it.

07·Integration levels

The level decides what can be governed.

L0
Inventoried
Exists with an owner and a group
L1
Observed
Telemetry, health, alerts, scorecards
L2
Controlled
Stop/play, limits, structured handoff
L3
Managed
Full lifecycle, verified retirement

L2 enables operational control. L3 enables the full lifecycle with verified retirement.

08·Security contact

Found something? Write to us.

Report vulnerabilities or incidents to security@kordana.ai. We acknowledge within one business day.

09·Tenant isolation

Dual-layer RLS, no service_role.

Isolation does not trust the application. There is an explicit facade (set_config of the kordana.workspace_id GUC + workspace_id filter) and FORCE ROW LEVEL SECURITY in Postgres under a no-bypass role: kordana_app, NOSUPERUSER NOBYPASSRLS.

Explicit workspace filter on every query (primary)
FORCE RLS as a safety net (defense in depth)
Application role cannot bypass — no accidental escalation
No service_role: no back door to manage

10·Quality buckets with a hard deny-list

Judges never leave Kordana.

Every inference is classified A/B/C by call-site —never by content. Bucket A (judges, verifiers, classifiers: whoever measures quality) only runs on kordana-hosted, with defensive re-check. B/C support full or configurable BYOAI. In doubt, Bucket A: the classification is fail-closed.

Kordana-hosted only

Judges, verifiers, classifiers. Hard deny-list against client providers.

Configurable BYOAI

Sensitive workloads. Routing by workspace policy.

Full BYOAI

General workloads. Any connected provider.

11·Edge enforcement, no proxy

We decide here. It's enforced there.

For clients with their own gateway or self-hosted endpoints, Kordana is the decision plane (PDP/PAP) and pushes Ed25519-signed policy —monotonically versioned— to the client's gateway (PEP). We reconcile via attestations and echoes; we raise violations. Hard, fail-closed enforcement without entering the data path or seeing inference traffic.

01
Kordana PDP/PAP
Publishes Ed25519-signed policy.
02
Signed push
Monotonic version, verifiable at the client.
03
Client PEP
Your gateway enforces the policy.
04
Reconciliation
Attestations + echoes → violations on drift.

HITL in the data path, no proxy. Kordana decides and governs but never sits as intermediary of the client's model traffic.

12·Humanity invariant

No agent signs governance.

A machine identity —API key, third-party agent— never signs governance decisions or starts runs on its own. Only humans authenticated via OIDC (or OTP for specific cases) can approve business cases, graduate to active or sign retirements.

OIDC

Federated authentication for operators and signers.

Email OTP

Second channel for sensitive transitions.

API keys

Integrators scoped per endpoint, default-deny in IAM.

Raise the level at your pace.

Start free by inventorying. Move up to observation, control or management unit by unit.

See pricing Start free