Security

Lumen treats browsers, prompts, retrieved documents, model output, generated code, runtime files, notebook content, and extension metadata as untrusted. A model suggestion never grants authority. The trusted control plane authenticates each actor, validates typed commands, fences generations, enforces policy and budget, and records durable outcomes.

Minimum posture

• tenant identity on every owned relation and composite tenant foreign keys;
• separate migration, app, worker, and support database roles;
• private isolated compute with default-deny egress;
• short-lived attempt/generation capabilities instead of raw provider credentials;
• staging-only hostile uploads and trusted create-only artifact promotion;
• explicit approval for mutating, credentialed, destructive, or external side effects; and
• secret, dependency, license, renderer, injection, and recovery gates before real data.

This is an engineering security model, not a compliance certification. Multi-tenant admission remains blocked until the independent security and isolation matrix passes.