The Grand Project — Security Requirements
`GRAND-PROJECT-SPECIFICATION.md` is authoritative.
Identity
- Central Authentication owns passwords and login credentials.
- Plugin Modules never store passwords.
- SSO across approved domains/subdomains.
- MFA support.
- User, service, installation and AI-agent identities are distinct.
Authorisation
Every request resolves:
```text
Identity
→ active status
→ company context
→ relationship
→ plugin access
→ permission
→ record policy
```
Permissions use `plugin.resource.action`.
Tenant isolation
- Company-private data is automatically scoped by framework context.
- Submitted `company_id` values are never trusted alone.
- Automated tests must prove cross-company isolation.
Web/API
- HTTPS only in production.
- Secure/HttpOnly/SameSite cookies.
- CSRF for state-changing web requests.
- Parameterised database access.
- Output escaping.
- API scopes.
- Rate limits.
- Request/correlation IDs.
- Idempotency for sensitive writes.
Files
- Validate MIME/content, extension and size.
- Sanitise names.
- Never place uploads in executable source directories.
- File ID alone does not grant access.
Secrets
Never store secrets in source, manifests, logs or public diagnostics.
Use Secrets Service abstraction.
Updates
- Signed packages.
- Checksum verification.
- Mandatory backup before changes.
- Automatic rollback after critical failure.
- Independent emergency recovery.
Logs
Redact:
- passwords
- access/refresh tokens
- API keys
- authorization headers
- cookies
- card data
- secret values
Production errors
Never expose stack traces, SQL, credentials, filesystem paths or secret configuration.
Return safe user-facing message plus request reference ID.