Security model

Identities

• Human users authenticate through native password/TOTP; optional GitHub PKCE may issue the same MonStaff session contract.
• MonStaff issues a 15-minute access token and a rotating refresh token bound to a persisted server-side session.
• Organization access carries OWNER, ADMIN or MEMBER and is derived from active native/provider membership grants.
• Each desktop profile owns one revocable Ed25519 DesktopInstallation identity reused by compliance, Local AI and Remote Actions.
• CI uses deployment/update credentials distinct from end-user identities.
• External providers use OAuth tokens or API keys stored server-side.

Sensitive assets

• MonStaff JWTs and GitHub/Hubstaff OAuth tokens.
• Provider API keys, JWT signing key and encryption key.
• Screenshots, window titles, application names, URLs and activity counts.
• Organization analytics and delivery data.
• Release artifacts and update-upload authority.
• Installation private keys, posture evidence, signed model packs, remote execution output and terminal transcripts.
• Agent chat content, lifecycle correlation, repository context, local bridge queue material and telemetry installation grants.
• Customer contacts, explicit work visibility, time allocations, report snapshots/artifacts, recipient snapshots and OnlyOffice/renderer tokens.

Authorization invariants

1. Authentication never implies access to an arbitrary resource ID.
2. Tenant scope follows the owned resource, principally Project.organizationId.
3. Screenshot/activity ownership follows TimeEntry.userId and its project.
4. Administrative actions consult current server-side membership.
5. Refresh cannot perpetuate revoked claims.
6. OAuth state is confidentially bound to the initiating client, single-use and expiring.
7. Imports can map only resources within the selected organization.
8. Device-scoped writes require current human access, an active installation and a fresh signed nonce-bound request.
9. Compliance findings never authorize Remote Actions; high-risk command launches repeat role, policy, recent-auth, target and privilege checks. Direct terminal create/attach repeats current admin, tenant, requester, recent-heartbeat and capability checks without password/TOTP reauthentication.¹
10. OTLP attributes supplied by a client never establish organization, user or installation scope; an authenticated gateway must overwrite trusted identity fields.
11. Customer-facing reads are explicit-allowlist and current-allocation only. Project membership alone never authorizes disclosure to every linked customer.
12. Report edit/download/renderer tokens bind tenant, object version, purpose and expiry; renderer destinations are loopback or HTTPS and cannot contain credentials or query strings.

Implemented controls

• AES-256-GCM encryption for stored provider tokens.
• Authorization policies load the persisted organization, project, entry, screenshot or issue before deciding access.
• Administrative routes re-read the current session, token version and membership rather than trusting stale role claims.
• GitHub OAuth uses PKCE, high-entropy state, atomic one-time challenges and one-time desktop callback codes; bearer tokens never travel in the custom protocol.
• Refresh-token rotation detects reuse and revokes the affected session family; GitHub membership reconciliation removes memberships absent from the provider response.
• Prisma parameterized access, Zod input validation, a partial unique running-timer constraint and durable idempotency records protect write integrity.
• The Tauri GUI holds no secrets: tokens, device keys, leases, encrypted queues and backend transport live in monstaff-core, reached over a loopback protocol that requires the per-user descriptor credential, checks the protocol version and rejects replayed request identifiers.
• Short-lived S3 operations use generated user/entry-scoped keys and registration verifies object type, size and existence.
• Global/auth/AI rate limiting.
• Installation signature verification, nonce replay protection and coordinated revocation across device capabilities.
• Compliance payload/time bounds, same-ID/different-digest rejection, immutable evaluation history, scoped exceptions and per-organization retention.
• Remote Actions immutable revisions, leased claims, single-use tickets, encrypted bounded output/transcripts, Redis cross-replica relay and fail-closed elevation.
• Local AI signed manifest/ticket binding, checksum/size/disk limits, no-follow regular-file verification and local-only sidecar execution.
• Agent ingest overwrites client tenancy from installation-bound authority; durable projector/governance jobs preserve idempotency, content capability separation, retention and auditable export/deletion failures.
• Customer mutations are transactionally tenant-scoped and audit only identifiers/changed-field summaries; tenant keys, URLs and contact content are not copied into audit metadata.
• Report template callbacks use purpose/document/session-bound expiring tokens and allowlisted origins; renderer requests reject credentials, query strings and redirects; delivery records ambiguous provider outcomes instead of retrying them as definitely unsent.
• Production error handler avoids returning internal details.

Route authorization matrix

Route family	Read	Write / execution	Administrative scope
Projects	Current organization/project member	Organization admin or owner; generic updates cannot transfer tenants	Persisted Project.organizationId
Work items and iterations	Member of the owning project	Accessible project plus operation/integration policy	Sync and workflow operations require current organization admin
Time entries	Entry owner	Owner and accessible project; work item must belong to that project	Reports remain database-filtered to the selected organization
Activity and screenshots	Entry owner	Owner of the parent entry; idempotent write contract	Current admin may report only inside the parent project organization
Imports	Current organization admin/owner	Same, with mappings constrained to that organization	OAuth challenge, job and provider mappings retain organization scope
Analytics and reports	Current organization admin/owner	Not applicable	Every database query is anchored through project organization
Authentication	Current persisted session	Rotation/logout affects only the authenticated session family	Roles and token version are revalidated from the database
Device Compliance	Own active enrollment/status	Signed installation snapshot; policy/evidence administration requires current admin/owner	Enablement/retention and critical exceptions require owner authority
Local AI	Own resolved policy and bounded inference	Signed installation reports/download authorization	Automatic download/switch policy requires owner confirmation
Remote Actions	Admin inventory/audit	Recent-authenticated command launch plus target/approval/privilege gates; direct terminal is server-fixed to unattended user level	Tenant policy, current membership, installation proof, heartbeat/capability and kill switches are rechecked across create/claim/attach/reconnect

Privacy

External AI context and window-detail collection default to disabled. The release candidate has no external AI or Ollama runtime: managed inference executes in a fixed local sidecar with minimized context. Compliance, AI logs, screenshots, import source files and remote output/transcripts have bounded retention paths. Production enablement still requires product/privacy/legal approval of disclosure, fields, licenses and retention.²

See the risk register for residual closure gates and the complete remediation plan for implementation evidence.

Footnotes

1. Direct administrator shell from managed devices. ↩

2. Greenfield release-candidate local implementation evidence. ↩