Security model
This page sets out the controls Olympusx AI provides, from who can sign in to how a release is verified, and states what each one protects. It is written for the security team reviewing an installation. It describes behaviour; the settings that turn controls on are in Network and hardening.
Identity
Section titled “Identity”- People sign in with your identity provider, over OpenID Connect, or with the built-in identity service if you have none. Olympusx AI keeps no passwords of its own and no separate user directory.
- Every request to the management API carries the person’s token, and the control plane decides it against the person’s tenant and role before any work is done. A route with no access rule is refused.
- Applications use API keys, not people’s tokens. Keys are shown once and stored as a slow, salted hash. A key belongs to one project; it can expire, be limited to named models, and be revoked with immediate effect.
- The gateway refuses a sign-in token, so a person’s session cannot be replayed as an API credential.
See Roles and permissions and Identity and sign-in.
Tenant isolation
Section titled “Tenant isolation”| Layer | Control |
|---|---|
| Records | Every tenant-owned row carries its tenant, and the database enforces row-level security on it, so a query that forgets to filter returns nothing rather than another tenant’s rows. An installation can also run the control plane under a database role that cannot change the schema or those policies. |
| Workloads | Each project has its own namespace on each cluster, with a resource quota, role bindings, and network policies that deny traffic by default. Model servers run there. |
| Knowledge | Each vector database belongs to one tenant. |
| Routing | The gateway routes on the tenant the platform resolved from the key, never on a value the client sent. |
| Keys | The caller’s key is removed before a request reaches a model server or a provider. |
Network policies are enforced only by a network plugin that enforces them. Check yours before you rely on namespace isolation; Verify the installation has the check.
Data in transit and at rest
Section titled “Data in transit and at rest”- TLS at the edge. The console and the gateway are published on their own host names, each with its own certificate, through your ingress or route.
- Credentials at rest (cluster tokens, connector, code host, tool server and provider secrets) are sealed with the installation’s master key. Generate it once and keep it in escrow.
Outbound connections
Section titled “Outbound connections”Olympusx AI opens no connection to the internet of its own accord. Every outbound connection is one an administrator or builder configured, and the console shows it. Tool servers are reached only at public https:// addresses or at private addresses your platform administrator allow-lists; loopback, link-local and cloud metadata addresses are never reached. See Sovereignty and data.
Content controls
Section titled “Content controls”- Guardrails scan prompts and answers for personal data, secrets, prompt injection, toxic content and banned topics, and fail closed by default. See Guardrails.
- Code is scanned for secrets before it is stored, and a diff kept for a merge request review is stored with its secrets redacted.
- Agents act only through granted tools, within ceilings, and any tool can be held for a person’s approval. See Human approval.
Record
Section titled “Record”- The audit log is hash-chained. Each entry carries a hash over its content and the entry before it, so a deleted or altered entry breaks the chain. The console verifies the chain on demand and exports it. See Audit.
- Retention and erasure are controlled, and every change to them is recorded in the audit log. See Sovereignty and data.
Supply chain
Section titled “Supply chain”Release images and charts are signed, by digest, and published with a software bill of materials. The public key and the verification steps come with your subscription; verification works inside an air-gapped network. See Verify the installation.
What remains yours
Section titled “What remains yours”- Your clusters and nodes, the network plugin that enforces network policies, and patching.
- Your identity provider, its password and session policies, and multi-factor authentication.
- TLS certificates for the two host names.
- Escrow of the master key, and backups of the platform database and vector databases. See Backup and restore.
- Network access to the platform’s metrics endpoint, which reports per-tenant token volumes.