# Security and identity model

## Purpose and scope

This diagram identifies trust boundaries and least-privilege controls across
public delivery, source workflows, k3s, Google Cloud, storage, and Terraform
state. Aggregate identity/storage metadata was checked on 24 July 2026, but the
diagram is not a full IAM-policy export.

**Source:** `sources/security-controls.mmd`  
**Generated:** `generated/security-controls.svg`

![Security and identity controls](generated/security-controls.svg)

## Components and trust boundaries

Public users cross TLS to the hosted site. Human and CI authentication are
bounded by source-control and workflow policy. Inside k3s, ServiceAccounts,
RBAC, NetworkPolicies, and backup encryption restrict workload behavior. A
projected workload token crosses the cluster-to-cloud boundary through Workload
Identity Federation to scoped IAM and private storage. Terraform state, DNS,
account administration, encryption-key custody, and restore approval have
separate owners.

## Data flow and failure paths

Public requests follow DNS/TLS to Firebase. Backup authentication follows
Kubernetes identity → federation → scoped cloud identity → storage authorization;
the archive is encrypted before that boundary. Expired or over-broad identity,
issuer/JWKS failure, denied IAM, public-access drift, missing NetworkPolicy,
state exposure, or lost decryption material requires a different response.

## Omissions and verification

Names, tokens, keys, provider IDs, encryption identities, state contents,
private addresses, and configuration values are omitted. Kubernetes manifests,
backup code, and Terraform/state evidence were reviewed. A read-only 24 July
inventory confirmed one active WIF pool/provider, zero user-managed
service-account keys in the portfolio project, uniform bucket access, and
enforced public-access prevention on the backup bucket. Notification delivery,
full policy bindings, billing ownership, and external DNS administration remain
outside that verification.

Related: `hybrid-cloud/docs/security.md` and
[visualization guidelines](../visualization-guidelines.md).

**Validation:** `npm run diagrams:check`.