Security
Security is not a layer bolted onto System9. It is the plane every path runs through. One identity model covers people, machines, and AI; governance is deny-closed; signatures travel with what they sign; classification is enforced everywhere; and everything is audited.
What's covered
| Area | What you'll find |
|---|---|
| The seven threads | The organizing spine: seven properties that hold on every path, to the device |
| Identity & Access | One directory and one authorization path for people, machines, and AI |
| Governance (Deny-Closed) | The gate that can say no, at the action boundary, with an audit record |
| Signing & Cryptography | The cryptographic system, signed-at-origin provenance, and post-quantum hybrid |
| Transport & WAF | Mutual TLS with identity in the certificate, the node web application firewall, and a posture-aware threat-level enforcer |
| Classification | One classification ladder enforced on every path |
| Compliance & Audit | Tamper-evident, hash-chained records that prove what happened |
| Security Operations | Streaming security telemetry on open standards (OCSF + Sigma) |
| Workspace & org isolation | Oversight above the governed unit; a boundary that is measured, not asserted |
The threads that run through everything
Seven threads are the organizing spine of the platform, each a property that holds at every layer, in every service, on every path, to a device in the field. See the seven threads for the full set; in brief:
- One identity, from a person to a field device. Six crypto-bearing principals share one foundation, one authorization path, and one crypto identity.
- What refuses, and what proves it refused. Denials are first-class and leave a record, governance has a read side, not just an enforcement side.
- Signed at origin, and the signature travels. Provenance is checkable later, offline, against a clock the verifier supplies.
- Everything is metered, attributed, and verifiable.
Related topics
- Agent identity and grants underpin the Agent Platform.
- Data reads are enforced by the Data Platform governance plane.