Security Model

The security model defines how Meridias separates tenant access, protects credentials, and constrains what data moves through the evaluation and routing layers.

Trust boundaries

Meridias should separate public API access, operator workflows, and internal control-plane functions. Clear boundaries reduce the blast radius of both operational mistakes and credential exposure.

Credential protection

Secrets should be stored in managed secret systems, rotated regularly, and scoped to specific environments or services. Human and machine access should be governed independently.

Network and service controls

Service-to-service communication should use authenticated channels and minimal network exposure. Administrative interfaces should be restricted and monitored separately from runtime traffic.

Auditability

Security-sensitive actions such as key issuance, policy changes, and access grants should be captured in audit logs that can be reviewed during incident response and compliance work.

Next step

Continue to Compliance and Data & Privacy for the supporting controls around this model.