Security & trust

We design for the moment credentials are not enough.

ProdPermit’s central security assumption is simple: possession of credentials does not equal justified authority.

Evidence before authority

A technically ready plan is still not executable authority.

ENFORCED

Exact permit bounds

Project, target, artifact, operation, validity, attempt and fence are material signed fields.

ENFORCED

Replay resistance

Durable idempotency, attempt accounting and monotonic fencing prevent duplicate execution.

ENFORCED

Unknown is not success

Missing runtime truth earns zero release credit and freezes authority.

ENFORCED

Separate trust domains

Product identity/workspaces live in a dedicated Neon project. Operational authority data remains separate.

ENFORCED

Advisory AI boundary

GitLab Duo can review and reason; model output cannot mint authority or declare runtime success.

ENFORCED

What we do not claim.

ProdPermit is currently a supervised, non-production staging system. We do not claim SOC 2 certification, production customer readiness, universal runtime verification, or hands-off production deployment. Those boundaries are product facts, not marketing footnotes.