Security at GlassPalace

GlassPalace is built around an intentionally powerful agent. Our architecture treats that runtime as untrusted to the host and isolates it from provider secrets and other workspaces.

Current Shopify app boundary

The Shopify app requires read_products and read_inventory. Optional read_orders can be enabled separately for minimized sales and profitability reporting. The order projection excludes customer names, emails, phones, addresses, and payment-card data, is never placed in the workspace Agent filesystem, and is purged when the scope is revoked. The app does not request Shopify reports or any write permission.

Workspace isolation

Every workspace receives a separate gVisor-sandboxed pod and persistent volume. Tenant namespaces use deny-by-default networking, admission controls, resource limits, and no direct public ingress.

Credential boundary

OAuth refresh tokens, API keys, managed model keys, and BYOK credentials remain encrypted in central services. The agent sees stable aliases and a short-lived workspace identity, not upstream secrets. The persistent workspace Agent is constrained away from Shopify protected order records; the optional financials projection is computed centrally and exposed only through authorized business summaries.

Authorization and mutation audit

Ory Kratos authenticates identities, and PostgreSQL membership and role checks authorize workspace paths. Every authenticated control-plane mutation is admitted only after its actor, route, workspace context, and request identifier can be durably recorded. If that admission event cannot be stored, the mutation handler is not invoked. High-impact provider operations are currently unavailable while the action-control system is being redesigned. These controls do not expand Shopify access beyond the two required read scopes and any separately merchant-authorized optional read_orders grant.

Storage assurance

Application traffic uses encrypted transport and provider credentials use application-layer encryption. Tenant-volume encryption and managed-database encryption are separate infrastructure controls. We do not treat TLS configuration or a storage-class name as proof that the production database and any provider-created snapshot are encrypted at rest; that assurance requires evidence for the exact deployed service.

Durability limitation

The service does not yet include off-node application backups. Storage loss can permanently remove agent state; this limitation is distinct from our controls against cross-tenant access.

Responsible disclosure

Please send security reports to geroale2000@gmail.com. Include reproduction steps and avoid accessing data that is not yours.