Decision Log

Organization administrators and security reviewers

Security

Understand authentication, authorization, scoped credentials, and deployment boundaries without treating identity as permission.

Task 1

Better Auth
Use verified human identities for web access and scoped API or MCP credentials for machine access.

Steps

  1. 1Human users verify their email before onboarding or application access.
  2. 2Web sessions identify the User; Organization membership and permissions are resolved separately.
  3. 3API keys and MCP client secrets are scoped machine credentials and must not be stored in source control.

Authentication proves identity. It does not grant Organization, Workspace, billing, or platform-administration access.

Task 2

Roles and permissions
Resolve custom RBAC and contextual ABAC at the Organization or Workspace boundary for every operation.

Steps

  1. 1Identify the authenticated Actor and requested Organization and Workspace.
  2. 2Resolve active membership, Role, and Permission assignments.
  3. 3Apply contextual restrictions such as Workspace grants.
  4. 4Fail closed and distinguish permission denial from missing data.

Route parameters, slugs, headers, and client-supplied Actor identifiers are context—not authorization proof.

Task 3

Deployment controls
Promote verified commits through Preview and production while keeping credentials and tenant data environment-scoped.

Steps

  1. 1Validate static analysis, unit, database, browser, Storybook, and production-build checks.
  2. 2Exercise an authenticated Preview smoke with dedicated non-customer credentials.
  3. 3Match the production deployment to the merged commit SHA.
  4. 4Check readiness and runtime errors before declaring the release complete.

Production health

curl --fail https://www.decisionlog.ai/api/health
curl --fail https://www.decisionlog.ai/api/ready

Continue with another workflow

Decision modelRecord immutable Decisions, retrieve the current answer, and preserve every change through explicit supersession.API and CLIAuthenticate scoped requests and use the public API or repository-local CLI against the same canonical operations.MCP and agentsRegister scoped MCP clients, discover supported tools and resources, and preserve Actor attribution for agent activity.Sources and extractionSubmit provenance-bearing source material, run reviewable extraction, and resolve DecisionCandidates explicitly.OperationsRun the application locally, execute the supported validation matrix, and collect evidence for a production release.
Create an accountAsk a question