Explicit Identity
Intended security and architecture principle; specific controls must be documented separately.
BLUETRIX Trust
Security through clear boundaries and traceable controls.
Architecture principles define what should be assessed and documented without claiming controls that have not been evidenced.
Security principles
Architecture principles, not blanket implementation claims.
Least Privilege
Intended security and architecture principle; specific controls must be documented separately.
Separation of Duties
Intended security and architecture principle; specific controls must be documented separately.
Defense in Depth
Intended security and architecture principle; specific controls must be documented separately.
Secure Defaults
Intended security and architecture principle; specific controls must be documented separately.
Traceability
Intended security and architecture principle; specific controls must be documented separately.
Identity and access
Authorisation considers business context.
A successful login alone does not automatically authorise every action.
- Actor identity
- Workspace or organisation context
- Role and membership
- Affected resource
- Requested action
- Business ownership
- Process status
- Data classification
- Delegated permissions
- Required approvals
Organisational boundaries
Workspace and organisation boundaries.
Principles to be assessed or intended; not a promise of complete tenant isolation.
- Unambiguous workspace assignment
- Controlled resource sharing
- Authorisation check
- Defined memberships
- Administrative roles
- Traceable changes to access rights
Technical protection areas
Areas to assess and document.
Mechanisms without evidence are not presented as implemented.
- Protection in transit
- Protection of stored data
- Production access
- Secret and credential management
- Backups and recovery
- Logging and monitoring
- Data deletion
- Secure exports
- Environment separation
Secure interfaces & development
Development and operational requirements.
- Authentication and authorisation
- Input validation
- Rate limits and replay protection
- Origin verification and idempotency
- Error handling and logging
- Code review and dependency management
- Vulnerability management
- Controlled releases and findings
Audit
Traceability of security-relevant actions.
Interaction Timeline, technical logging and security audit are separate information areas.
- Who initiated the action?
- In which workspace?
- Which resource was affected?
- Which permission was used?
- Which state change occurred?
- Which automation or agent was involved?
- Which approval was present?
- Which subsequent events occurred?
Incident Readiness
A process without invented SLAs.
- 1Detection and reporting
- 2Classification
- 3Containment
- 4Investigation
- 5Remediation
- 6Recovery
- 7Required communication
- 8Follow-up
Security status
Status requires real evidence.
Implemented controls, improvements, measures, assessments, evidence, limitations and updates must be documented using real status data. This page does not invent status values.
Security questions deserve specific answers.
Request currently available information about architecture, controls and responsibilities.