Security Architecture
How GIIP isolates, authenticates and constrains what the agent can do.
- Network boundary — agents use outbound HTTPS (443) only via queue polling; no customer-side inbound opening.
- Credentials — customer credentials are completed inside the FDE Box and are not sent externally.
- Authentication — API access uses a Secret Key (SK); the admin UI uses login plus permission levels.
- Least privilege — agents execute only approved commands (CQE) from the central queue.
- Multitenancy — the FDE Box is a per-customer physical machine, giving physical isolation.
- Encryption — TLS in transit; DB/KVS is not encrypted at rest (passwords are hashed with SHA-256).
- Vulnerability & monitoring — periodic vulnerability collection with manual patching; every execution is logged to KVS with a 5-min heartbeat, and ErrorLogs→AICQE auto-detects errors.
- Certifications — none currently held (stated transparently).