# Security

> Every control: what it is, where it is enforced, and how you can verify it yourself.

This section is written for the person who has to sign off on LightHouse: a security architect, a reviewer, or the engineer who will be asked “how do you know?”.

Each control is described the same way:

- **What it is.** One or two sentences, no adjectives.
- **Where it is enforced.** The component that refuses, and whether it sits in your account or in Atlantic’s.
- **How to verify it.** A request you can send, a header you can inspect, or a record you can read in your own audit log.

Anything not built yet is marked \[Coming], with no date.

## The design in one paragraph

The engine runs in your account and holds your content. LightHouse runs in Atlantic’s account and holds operational telemetry: counts, costs and timings, never content. When a person in LightHouse needs to see content, it is read in place from your account and shown to them, not copied. Every connection between the two is opened from your side, and every message across it is signed. The [architecture page](/security/architecture/) draws this boundary.

## The controls at a glance

| Control                                                                                                              | Enforced in                            | Verify it with                                                                    |
| -------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | --------------------------------------------------------------------------------- |
| [Sign-in through your identity provider, MFA required](/security/api/#people-sign-in-through-your-identity-provider) | The edge and the LightHouse service    | `GET /api/v1/me` shows how your second factor was proved                          |
| [Machine keys: read only, one tenant, 365 days at most](/security/api/#machines-a-key-and-a-service-token)           | LightHouse service                     | A key at another tenant’s host answers `401`                                      |
| [Tenant isolation by row-level security](/security/api/#tenant-isolation-in-the-database)                            | The database                           | Every query runs under your tenant’s scope; nothing names a tenant in a parameter |
| [Writes audited](/security/api/#every-write-is-audited)                                                              | LightHouse service                     | `GET /api/v1/audit`                                                               |
| [A key may never pay, raise a limit or approve](/security/api/#what-a-machine-key-may-never-do)                      | LightHouse service and your handler    | Those routes answer `403 person_required` to a key                                |
| [MCP is read only](/security/mcp/)                                                                                   | LightHouse service                     | No tool approves, pays or changes a limit                                         |
| [Retrieved text is evidence, never instruction](/security/mcp/#prompt-injection)                                     | The engine, in your account            | The tool gate refuses what the agent’s card does not permit                       |
| [Content security policy with a per-request nonce](/security/ui/#content-security-policy)                            | The portal                             | Inspect `Content-Security-Policy` on any page                                     |
| [Spending caps and kill switches in code](/security/engine/#caps-and-kill-switches)                                  | The gateway, in your account           | A refused call is a `model_call` with `outcome: refused`                          |
| [The Cedar tool gate](/security/engine/#the-tool-gate)                                                               | The engine, in your account            | The `tool_denials_total` metric in your account, by reason                        |
| [No long-lived cloud keys](/security/engine/#no-long-lived-keys)                                                     | Your cloud’s identity service          | Read the roles the stack creates                                                  |
| [Signed telemetry](/security/supply-chain/#signed-telemetry)                                                         | Your deployment signs; intake verifies | An unsigned post answers `401 unsigned`                                           |
| [Scanning on every commit and pipeline](/security/supply-chain/)                                                     | Atlantic’s repositories and CI         | Ask for the latest reports under NDA                                              |

The [security controls summary](/trust/security-controls/) puts the same rows on one page for a questionnaire.

## Where to start

[Architecture and trust boundary](/security/architecture/)What runs where, and the three things that cross.

[API security](/security/api/)Sign-in, roles, keys, isolation, limits and audit.

[Engine and gateway](/security/engine/)Controls in code the model cannot reach.

[Verify it yourself](/security/verify/)Tests you can run from outside, today.

Data handling has its own section: [Data sovereignty](/data-sovereignty/).

Source: https://docs.atlanticagenticlabs.com/security/