AXIS Documentation / Security / Security Model

Security Model

VerifiedTLS partialRBAC / SSO / KMS planned

AXIS v0.6–v0.9 is a pilot-grade control layer, not an enterprise access-control system. This page states the model honestly: what is protected, what is trusted, and what remains outside the v1 guarantee.

Security principles

Deterministic policy, not AI judgment — decisions come from the policy engine, never from generative guessing.
Evidence before execution — durable decision evidence must be written before protected execution proceeds.
Fail closed — unknown, ambiguous, or unsupported inputs are rejected or blocked; there is no permissive default.
Defense in depth — classification risk signals backstop classifier correctness, but never replace it.
Honest boundaries — unverified identity, absent RBAC/SSO, local evidence, and no external key management are documented, not hidden.

Trust boundaries

Asset	Protection in v1
SQL classification	Contract v1.0 + CI mutation tests + evasion corpus
Policy files & manifest	Local SHA-256 integrity checks; no signing or external distribution in v1
Audit WAL	Hash chain + fail-fast corruption detection; not an external tamper-proof ledger
Approval store	Local SQLite / JSONL; immutable resolution; operator-token gated
DB credentials	`DATABASE_URL` / `DB_*` env vars; `axis_executor` role runs with limited privileges in the pilot stack
Operator control	`AXIS_OPERATOR_TOKEN` bearer token; unconfigured = unblocked local dev, reported as `operator_auth_enabled: false`
Runtime logs	Operational visibility only; not evidence

Identity: unverified in v1

Identity fields (actor, app, tenant, role, host, env) are not verified. They are evidence and policy inputs, not identity claims. "AXIS is not an authentication system." v0.9 adds optional JWT context (AXIS_JWT_REQUIRE_VALID_JWT=false): JWT-based identity can feed policy context, but is off by default and does not replace the v1 honesty model. Planned (not shipped): RBAC, SSO, signed identity, KMS-backed key management.

Runtime hardening controls

Control	Variable	Default
Request timeout	`AXIS_REQUEST_TIMEOUT_MS`	10000
DB query timeout	`AXIS_DB_QUERY_TIMEOUT_MS`	8000
DB pool max connections	`AXIS_DB_POOL_MAX_CONNECTIONS`	10
Max body bytes	`AXIS_MAX_BODY_BYTES`	1048576 (1 MB)
Max SQL bytes	`AXIS_MAX_SQL_BYTES`	262144 (256 KB)
Rate limit (per minute)	`AXIS_RATE_LIMIT_REQUESTS_PER_MINUTE`	120
Rate limit burst	`AXIS_RATE_LIMIT_BURST`	30
Prepared sessions	`AXIS_MAX_PREPARED_SESSIONS`	1000
Max pending approvals	`AXIS_MAX_PENDING_APPROVALS`	1000
Approval default TTL (seconds)	`AXIS_APPROVAL_DEFAULT_TTL_SECONDS`	300
Reload disabled by default	`AXIS_ENABLE_POLICY_RELOAD`	false

Controls apply at different layers: some are enforced in the AXIS API (body/SQL size), some at the database adapter (pool, timeouts), some at audit (fsync), and some at runtime (rate limit, approval TTL).

TLS posture

AXIS_TLS_ENABLED (default false) with cert/key variables exists; the v0.6 pilot runs plaintext on the trusted lab network with the documented caveat that production TLS review is pending.
The Control Plane runs over HTTPS in production mode; the pilot stack runs over HTTP on localhost.
AXIS → PostgreSQL connection security: PGSSLMODE-related variables are available but not part of the complete v0.6 story.
Production requirement (documented in review docs): mTLS between AXIS and clients, TLS to PostgreSQL, and operator security review.

Anti-evasion posture

Raw NUL bytes, invalid UTF-8, mixed encodings, comments, dollar-quoting, Unicode confusables → rejected as untrusted input.
Multi-statement payloads → rejected by default policy.
Extended-protocol parameter bypass attempts → rejected (PARSE_REJECTED_UNTRUSTED_INPUT).
Copies, COPY TO PROGRAM, ALTER SYSTEM, data-modifying CTEs → blocked or overridden.
Unknown statement shapes → QueryType::Unknown → Write/Block default.
Evasion corpus in CI grows with each documented bypass attempt.

Documented limits

No native authentication on the AXIS HTTP listener in v1 (JWT optional in v0.9, off by default).
No RBAC/SSO, no KMS, no external signing authority, no external audit ledger.
Identity fields unverified; approvals are single-operator gated, not multi-party.
AXIS protects operations that pass through AXIS; direct database access must be closed by network, roles, and credentials.
Bypass paths (direct DB access, emergency mode, unencrypted lab traffic) are documented risks for the pilot phase.

AXIS is not compliant enterprise software. For production, the documented review gates (mTLS, TLS to PostgreSQL, operator token policy, JWT adoption, external evidence handling) must be completed first.