Security Review
An honest security review: what AXIS v0.6–v0.9 does protect, what it does not, the accepted risks for the pilot phase, and the review gates required before production.
What the v1 model protects
- Deterministic SQL write-path control: classification, policy and approval enforced before execution.
- Durable, hash-linked evidence for every decision and execution outcome.
- Fail-closed handling of unknown SQL, unsupported shapes, and evidence failures.
- Versioned, validated policy lifecycle with rollback and operator-gated activation.
- Protection against documented bypass attempts (evasion corpus, extended-protocol parameter smuggling).
What v1 does not protect
| Area | Status | Note |
|---|---|---|
| HTTP listener authentication | None in v1 | JWT context optional in v0.9, off by default; no native auth |
| RBAC / SSO | Planned | Not shipped; approvals are single-operator gated |
| Identity verification | Unverified | Identity fields are evidence inputs, not verified claims |
| TLS / mTLS | Implemented | Client-to-AXIS and AXIS-to-backend mTLS (2026-08); negative matrix 18/18; cleartext lab-only; certificate lifecycle review remains |
| External key management | Planned | Local SHA-256 and optional Ed25519 only; no KMS |
| External tamper-proof ledger | Planned | Hash chain is local; not consensus/attestation |
| Direct database access | Bypass exists | Must be closed by network, roles, credentials |
| Wire protocol in production | Lab only | Simple Query POC; Extended Query planned |
Accepted risks for the pilot
- Cleartext traffic is possible only as an explicit lab-only configuration; production profile enforces mTLS (
AXIS_TLS_REQUIRE_CLIENT_CERT=true). - Unverified identity fields in policy decisions and approvals.
- Single-operator approval model (one token, one reviewer).
- Local-only evidence; no external anchoring.
- Direct DB access bypass unless deployment closes it.
Production review gates
Complete the mTLS review and certificate lifecycle: rotation, expiry monitoring, key management (KMS when available); disable all lab-only cleartext paths.
Operator token policy: rotation, storage, least privilege.
Adopt JWT-based identity context and map to RBAC when available.
External evidence handling: off-box backups, signing, ledger anchoring when available.
Third-party penetration test and compliance review.
Evidence integrity assessment
- Integrity: SHA-256 chain + fail-fast detection; verified via
/evidence/verify. - Authenticity: local files trusted; optional Ed25519 bundle signing (not core guarantee).
- Non-repudiation: not claimed at v1 — identity unverified, no external authority.
- Confidentiality: not claimed at v1 — evidence is local and unencrypted by default.
- Availability: local only; operator responsibility for backups and retention.
Mitigation roadmap
| Mitigation | Status |
|---|---|
| JWT identity context (opt-in) | v0.9 |
| Evidence signing (Ed25519) | Implemented |
| mTLS (client-to-AXIS + AXIS-to-backend, negative matrix 18/18) | Implemented (2026-08) |
| RBAC / SSO | Planned |
| KMS-backed key management | Planned |
| External ledger anchoring | Planned |
This review is self-assessed from the project's own documentation. It is not a third-party security audit. Do not treat it as a compliance certification.
Related: Security Model · Limitations · Pilot