Secrets and security

Keep credentials, identities, permissions, and project boundaries explicit.

Continual separates platform access from business authorization. The platform authenticates the actor and project; the backend decides what that actor may do to business data.

Secret handling

Credentials are write-only references. Clients provide or rotate them; read APIs never return their values. Runtime access is separately authorized and auditable.

Layered enforcement

  • Identity establishes the person or delegated agent.
  • Workspace and project membership establish platform scope.
  • Backend authorization governs objects and tools.
  • Approval policy gates consequential actions.
  • Events record material decisions and effects.

Security checklist

  1. Use the narrowest role

    Grant only the capabilities needed for the operation.

  2. Gate irreversible work

    Require review where money, access, customers, or deletion are involved.

  3. Keep authority server-side

    Do not rely on hidden buttons, prompts, or client-side checks.

  4. Review the evidence

    Use events, changes, and deployment history to investigate behavior.