Avectes
Menu

SECURITY

Trust needs a boundary and a record.

Security claims should name who makes a decision, where it is enforced, and what evidence supports it. These are the documented Avectes boundaries and their present proof limits.

DOCUMENTED RULEBOUNDED PROOFOPEN BINDING

01 / AUTHORIZATION

An interface cannot grant access.

The App authorization rule starts with a global User identity, then evaluates OrganizationMembership, role, and the requested action for the target organization at a trusted server boundary. Hiding a control in the interface is only a usability choice.

DOCUMENTED DECISION PATH

  1. 01 / IDENTITYVerified userOne canonical user
  2. 02 / CONTEXTMembership + roleTarget organization
  3. 03 / BOUNDARYServer decisionRequested operation

Cognito native authentication has a settled App source boundary. Provider token verification, user admission, and organization access remain distinct checks; source work does not establish live provider activation.

Boundary status: documented App rule and source path. Live provider activation and production enforcement are separate evidence questions.

02 / CUSTODY

Every credential has a narrower destination.

Infrastructure policy gives workloads scoped roles instead of embedded long-lived AWS credentials. Operator, pipeline, build, task, and research responsibilities have separate least-privilege boundaries. Secrets belong in managed custody and should reach only the workload that needs them.

CONTROL / AUTHORITYEVIDENCE STATE
Workload identity

Scoped IAM roles and explicit environment access

DOCUMENTED RULE
Secret custody

Managed authority; no secrets in source, artifacts, or logs

DOCUMENTED RULE
Runtime observation

Bounded logs, alarms, and ownership require live binding

OPEN BINDING

Exact service bindings, rotation, retention, alarms, and escalation need their own operational evidence. This record states policy, not a live control dashboard.

03 / RECOVERY EVIDENCE

A backup claim ends at a tested restore.

Every authoritative store needs a backup, retention, restore, and restore-test contract. The September 2026 temporary Aurora exercise proved a bounded synthetic snapshot and restore path. Its disposable resources were removed. That proof does not enroll a standing product database or qualify protected recovery execution.

  1. RULERecovery contract

    Backup and restore-test requirements are documented.

  2. BOUNDED PROOFSynthetic drill

    A temporary Aurora path was exercised in September 2026.

  3. OPENProduct readiness

    Standing resource, protected execution, and measured outcomes need proof.

This public site has no live monitoring connection. The status page reports unknown instead of inferring health or an outage.