Skip to content
Dewee.sh Documentation

Security & Permissions

.md

Security & Permissions

Section titled “Security & Permissions”

5-Layer Security Architecture

Section titled “5-Layer Security Architecture”
  1. Transport Layer: Strict TLS and redirect: "manual" proxy policies with fixed upstreams.
  2. Authentication: Server-side token resolution and scoped API key verification (internal/http/auth.go).
  3. Authorization & RBAC: Role hierarchy (Owner > Admin > Operator > Viewer).
  4. Tenant Isolation: Application-level tenant scoping (WHERE tenant_id = $N, store.WithTenantID(ctx), and store.IsMasterScope(ctx)).
  5. Execution Sandboxing: Docker container isolation with restricted network capabilities and shell deny patterns.