Security Model

GWEB K3s Cloud separates tenant application operations from GWEB platform administration.

This page describes only the tenant-facing security model.

Tenant identity

Tenant users authenticate through the identity flow configured for their tenant and operate through tenant-safe GWEB Cloud interfaces and gwebc.

Authentication establishes identity. Authorization still determines what that identity may do.

Tenant authorization

Tenant authority can depend on:

• tenant membership;
• assigned tenant role;
• delegated capabilities;
• environment;
• application ownership;
• environment mutation policy;
• service-exposure authority.

A successful login does not grant unrestricted access.

Tenant isolation

A tenant should not expect authority over:

• another tenant's applications;
• another tenant's namespaces;
• GWEB platform resources;
• cluster-wide infrastructure.

Tenant namespaces and environments remain bounded by GWEB Cloud authorization.

Production protection

Production can have stricter controls than development or preproduction.

A tenant may be able to inspect production while production mutation remains available only through the approved promotion workflow.

Credential boundary

Tenant users should never share:

• access tokens;
• refresh tokens;
• local session data;
• tenant VPN private keys;
• service credentials.

Tenant workflows do not require platform-administrator credentials or direct cloud-provider credentials.

Private CLI distribution

The public documentation is separate from the private gwebc package.

gwebc is provided separately only to approved tenants and selected developers.

This documentation site does not provide a public CLI binary, installer, package repository, or unrestricted download URL.

Managed egress authorization

Tenants do not receive direct Kubernetes NetworkPolicy privileges.

The authorization path is:

tenant identity
  -> gwebc
  -> tenant broker
  -> deployment controller
  -> managed NetworkPolicy

The current E3 profile is restricted to application-scoped public HTTPS egress in mutable non-production environments.