Security model

Identity and tenancy

The console resolves Databricks Apps forwarded identity only when the explicit trust flag and App name are present and the workspace identity boundary is authenticated. Actor and organization never come from a form, workflow signal, action payload, or CLI flag.

Authority

Platform Host evaluates entitlement, submission authorization, execution-time reauthorization, policies, state transitions, and approval authorization. Trusted workers, agents, installers, and evidence producers have separate narrow admission sets. Agents never receive certification, acceptance, waiver, approval, policy, cutover, or rollback permissions.

Secrets and evidence

Secrets remain in Databricks or deployment secret stores. Durable records carry opaque references and redact common token, key, password, and secret field shapes. Certificate private keys are secret-backed; offline verification uses public keys.

External effects

Adapters define timeout, retry class, provider idempotency, checkpoint, redaction, and reconciliation. A non-idempotent cutover effect is attempted once and independently verified. Unknown outcomes fail closed.

Production readiness additionally requires spoof, OBO, cross-tenant, agent-bypass, separation-of-duties, signature-tamper, replay, cancellation, restart, and source-and-target integration negative tests.