Documentation / Security & Access
Security, access and isolation boundaries
Rippflow separates Controller access, workflow deployment approval, and runtime handler or tool execution into three independent trust boundaries.
A Controller role alone never grants arbitrary workflow deployment authority. Deployment requires approved handler bindings or manifests and installation owner capabilities.
Three distinct security boundaries
- A. Controller & UI permissions:
IngressMode=public-edge(CloudFront + WAFv2 + S3 OAC + Function URL OAC) orprivate-enterprise(internal ALB + private DNS),__Host-rippflow_session(HttpOnly) browser sessions where Valkey stores only HMAC-keyed session validity ({"v":1,"active":true}+ TTL, zero PII/credentials/claims) and DynamoDB verifies identity and permissions on every request,X-Rippflow-Csrf,X-Rippflow-Machine-TokenCLI/CI auth, tenant isolation and Enterprise SSO/RBAC. - B. Workflow deployment permissions: Immutable manifest locks, pre-approved Lambda/Batch bindings, scoped AWS IAM publication and admission.
- C. Handler & tool execution permissions: Dedicated Lambda or scoped STS roles, per-tool MCP scopes, tenant secrets and prompt-injection envelopes.
Identity, Login & Roles →Browser PKCE login, OS keyring profiles, fixed roles and MFA.Workflow & Handler Permissions →Manifest locks, scoped AWS IAM deployers, activation and admission.Enterprise SSO & RBAC →IdP group bindings, custom scopes and team/project attribution.Secrets, IAM & Isolation →Workload IAM roles, MCP tool scopes, SSRF rules and runtime isolation.Audit & Recovery →Audit intents, session/group revocation, MFA escrow and cell fencing.
Role, authority and availability matrix
| Capability / Boundary | viewer (readOnly) | operator | deployer (readWrite) | admin | Enterprise IdP / Scoped IAM deployer | Availability status |
|---|---|---|---|---|---|---|
| Read workflow catalog, executions & permitted logs | Allowed (workflow:read, workflow:logs:read) | Allowed | Allowed | Allowed | Allowed via verified group grant or IAM read/inspect | Implemented (>=1.0.0) |
| Inspect & approve governed tool operations | Read-only | Allowed (operations approve|reject) | Allowed when granted operation scope | Allowed | Custom scope + bound input digest | Version-gated (>=1.7.0) |
| Cell health, drain & failover operations | Denied | Allowed with cell operation grant | Denied | Allowed (requires owner-cells-v1 on >=1.9.1) | Custom scope / owner-bound | Version-gated (>=1.2.0 / >=1.9.1) |
| Publish, activate or roll back legacy workflow manifests | Denied | Denied | Requires deployment:write + approved manifest/bindings (retired on read-only Controller unless owner-registry-v1 is bound) | Same as deployer (no automatic bypass) | Requires custom scope + approved manifest | Version-gated (>=1.0.0; owner gateway >=1.9.1) |
Scoped workflow publication & dispatch (scoped-deployments-v1 / native-iam-v1) | Denied (Controller JWT not accepted) | Denied | Denied without AWS IAM grant | Denied without AWS IAM grant | Allowed via SigV4 IAM: Default mode checks PRINCIPAL#{RoleId|UserId} in GrantPoliciesTableName; NativeIAM mode checks role path /tenants/<tenantId>/<role> or /rippflow-admin/<role> | Version-gated (>=1.9.0) |
Create/list basic users (rippflow users) | Denied | Denied | Denied | Allowed (users:manage; cannot write principal policies or handler approvals) | Allowed when group maps to admin / users:manage | Version-gated (>=1.8.0) |
Bind/revoke IdP groups & org attribution (rippflow rbac) | Denied | Denied | Denied | Standard tiers: HTTP 403 | Allowed on Custom/Enterprise tiers with AuthMode=oidc and rbac:manage | Version-gated (>=1.8.0); live customer IdP not certified |
| Mandatory TOTP / passkey MFA & admin recovery-code escrow | Required by policy | Required by policy | Required by policy | Required + customer Secrets Manager escrow | Upstream IdP MFA assurance required | Planned / contract defined (not enabled on default TEST pool) |
| Handler runtime IAM execution & subprocess workspaces | N/A | N/A | Cannot self-approve roles | Operator registers approved roles in installation | Dedicated Lambda role (main) or scoped STS subprocess (core PR #27 / runner PR #8); managed workspace.rs absent on main | Configured / candidate patch; workspace.rs Planned |
Verified sources
Checked 2026-11-05.
- Authentication tiers and RBAC 3a3be99 · main
- Scoped deployment contract v1 3a3be99 · main
- Native IAM deployment authorization 3a3be99 · main
- Execution role and session guardrails 04cb082 · main
- Controller JWT and grant verification f6c7970 · main