Security Overview
The Context Graph security subsystem provides fine-grained access control through tool-level permissions, role-based access control (RBAC) with visibility levels, and semantic feature flags for per-tenant rollout control. All API endpoints are protected by the authorization middleware, and data visibility is dynamically filtered based on user permissions.
Subsections
| Page | Description |
|---|---|
| Tool Permissions | Fine-grained tool access control for MCP tools |
| Role-Based Access Control | RBAC with permission-based visibility levels |
| Semantic Feature Flags | Per-tenant feature rollout with canary support |
Security Layers
Request --> JWT Authentication --> Tenant Context --> RBAC Check --> Visibility Filter --> Response- JWT Authentication -- Validates the JWT token and extracts user identity
- Tenant Context -- Resolves the tenant scope from the token claims
- RBAC Check -- Verifies the user has the required permissions
- Visibility Filter -- Filters response data based on the permission-derived visibility level
- Response -- Returns data at the appropriate detail level