Agentic orchestration, deterministic enforcement

The design principle the whole platform is built around: agents may reason, propose and coordinate, but the authority to act lives outside the language model, applied by code. Persuading the model is therefore never sufficient to cause harm — because the model was never where the decision to allow an action was made.

The identity provider authenticates; ROOTVIEL authorizes. The code asks for permissions, not roles — it checks "may this principal approve an assessment?", never "is this principal an approver?". Roles map to frozen sets of permissions; a role with no mapping can do nothing, and a new permission is held by nobody until it is assigned. Deny-by-default, in both directions.

Enforcement is fail-closed everywhere. Token verification uses an explicit algorithm allow-list and never the token’s own declared algorithm. The capability catalog is validated against a closed family list before anything is signed. The signer refuses any key or signature that is not the expected Ed25519 shape.

Inside the agent, every tool call passes a single enforcement gate with deny-by-default checks in a fixed order: is the capability valid, is the honest risk floor acceptable, does the profile permit it, does a grant cover it. The agent cannot skip the gate, and it cannot self-authorize — the grant comes from a human operator, never from the agent’s own reasoning.

The requester of an assessment cannot be its approver — a reviewer role exists precisely so that whoever approves need not, and must not, be able to create what they approve. Sensitive capabilities also require step-up: a strong, recent authentication whose freshness window scales with blast radius. A reversible daily analysis accepts a wide window; approving a live test or transferring ownership demands a very recent strong authentication. The control does not run a second factor itself — it verifies what the identity provider attests, and absence of a strong signal is treated as weak, never strong.

When one agent delegates to another, authority can only shrink. A child’s authority is a subset of its parent’s across every dimension — organization, scope, capabilities, grants, risk and budget. Attenuation is monotone downward: information may grow as the investigation proceeds, but authority never does. An attempt to escalate is rejected at the first dimension that tried.

One platform operates on many organizations’ systems, so a missed tenant filter is a cross-client leak. Isolation is enforced in three layers: the tenant travels in a context set once from the verified token; repositories read the tenant from that context, never as a parameter, so a cross-tenant query is not even expressible; and the database applies row-level security per transaction.