AXIS Documentation / Security / Security Model

Security Model

VerifiedmTLS implementedRBAC / SSO / KMS planned

AXIS v0.6–v0.9 is a pilot-grade control layer, not an enterprise access-control system. This page states the model honestly: what is protected, what is trusted, and what remains outside the v1 guarantee.

Security principles

Deterministic policy, not AI judgment — decisions come from the policy engine, never from generative guessing.
Evidence before execution — durable decision evidence must be written before protected execution proceeds.
Fail closed — unknown, ambiguous, or unsupported inputs are rejected or blocked; there is no permissive default.
Defense in depth — classification risk signals backstop classifier correctness, but never replace it.
Honest boundaries — unverified identity, absent RBAC/SSO, local evidence, and no external key management are documented, not hidden.

Trust boundaries

Asset	Protection in v1
SQL classification	Contract v1.0 + CI mutation tests + evasion corpus
Policy files & manifest	Local SHA-256 integrity checks; no signing or external distribution in v1
Audit WAL	Hash chain + fail-fast corruption detection; not an external tamper-proof ledger
Approval store	Local SQLite / JSONL; immutable resolution; operator-token gated
DB credentials	`DATABASE_URL` / `DB_*` env vars; `axis_executor` role runs with limited privileges in the pilot stack
Operator control	`AXIS_OPERATOR_TOKEN` bearer token; unconfigured = unblocked local dev, reported as `operator_auth_enabled: false`
Runtime logs	Operational visibility only; not evidence

Identity: unverified in v1

Identity fields (actor, app, tenant, role, host, env) are not verified. They are evidence and policy inputs, not identity claims. "AXIS is not an authentication system." v0.9 adds optional JWT context (AXIS_JWT_REQUIRE_VALID_JWT=false): JWT-based identity can feed policy context, but is off by default and does not replace the v1 honesty model. Planned (not shipped): RBAC, SSO, signed identity, KMS-backed key management.

Runtime hardening controls

Control	Variable	Default
Request timeout	`AXIS_REQUEST_TIMEOUT_MS`	10000
DB query timeout	`AXIS_DB_QUERY_TIMEOUT_MS`	8000
DB pool max connections	`AXIS_DB_POOL_MAX_CONNECTIONS`	10
Max body bytes	`AXIS_MAX_BODY_BYTES`	1048576 (1 MB)
Max SQL bytes	`AXIS_MAX_SQL_BYTES`	262144 (256 KB)
Rate limit (per minute)	`AXIS_RATE_LIMIT_REQUESTS_PER_MINUTE`	120
Rate limit burst	`AXIS_RATE_LIMIT_BURST`	30
Prepared sessions	`AXIS_MAX_PREPARED_SESSIONS`	1000
Max pending approvals	`AXIS_MAX_PENDING_APPROVALS`	1000
Approval default TTL (seconds)	`AXIS_APPROVAL_DEFAULT_TTL_SECONDS`	300
Reload disabled by default	`AXIS_ENABLE_POLICY_RELOAD`	false

Controls apply at different layers: some are enforced in the AXIS API (body/SQL size), some at the database adapter (pool, timeouts), some at audit (fsync), and some at runtime (rate limit, approval TTL).

TLS posture

TLS/mTLS implemented on the shared write-path transport (2026-08): client-to-AXIS with AXIS_TLS_REQUIRE_CLIENT_CERT, AXIS-to-PostgreSQL upstream mTLS (AXIS_TLS_UPSTREAM_*); negative matrix 18/18 — plaintext and certificate-verification-bypass mutations fail closed.
Cleartext is a lab-only configuration; the production profile rejects AXIS_TLS_REQUIRE_CLIENT_CERT=false.
The Control Plane runs over HTTPS in production mode; the pilot stack runs over HTTP on localhost.
pg_hba baseline (AXIS_ENFORCE_PG_HBA_BASELINE) enforces a proxy-only hostssl/cert posture; drift → signed AXIS_PG_HBA_DRIFT_DETECTED audit event.
Remaining requirement (documented in review docs): certificate lifecycle management, operator security review, KMS-backed keys.

Anti-evasion posture

Raw NUL bytes, invalid UTF-8, mixed encodings, comments, dollar-quoting, Unicode confusables → rejected as untrusted input.
Multi-statement payloads → rejected by default policy.
Extended-protocol parameter bypass attempts → rejected (PARSE_REJECTED_UNTRUSTED_INPUT).
Copies, COPY TO PROGRAM, ALTER SYSTEM, data-modifying CTEs → blocked or overridden.
Unknown statement shapes → QueryType::Unknown → Write/Block default.
Evasion corpus in CI grows with each documented bypass attempt.

Documented limits

No native authentication on the AXIS HTTP listener in v1 (JWT optional in v0.9, off by default).
No RBAC/SSO, no KMS, no external signing authority, no external audit ledger.
Identity fields unverified; approvals are single-operator gated, not multi-party.
AXIS protects operations that pass through AXIS; direct database access must be closed by network, roles, and credentials.
Bypass paths (direct DB access, emergency mode) are documented risks; cleartext is lab-only configuration and excluded by the production profile (AXIS_TLS_REQUIRE_CLIENT_CERT=true).

AXIS is not compliant enterprise software. For production, the documented review gates (mTLS certificate lifecycle, TLS to PostgreSQL, operator token policy, JWT adoption, external evidence handling) must be completed first.