Secrets and security
Keep credentials, identities, permissions, and project boundaries explicit.
Continual separates platform access from business authorization. The platform authenticates the actor and project; the backend decides what that actor may do to business data.
Secret handling
Credentials are write-only references. Clients provide or rotate them; read APIs never return their values. Runtime access is separately authorized and auditable.
Layered enforcement
- Identity establishes the person or delegated agent.
- Workspace and project membership establish platform scope.
- Backend authorization governs objects and tools.
- Approval policy gates consequential actions.
- Events record material decisions and effects.
Security checklist
Use the narrowest role
Grant only the capabilities needed for the operation.
Gate irreversible work
Require review where money, access, customers, or deletion are involved.
Keep authority server-side
Do not rely on hidden buttons, prompts, or client-side checks.
Review the evidence
Use events, changes, and deployment history to investigate behavior.