Security and trust
Common questions about Durin's security model, data handling, and trust boundaries.
What does the gateway’s access boundary cover?
The gateway applies its controls to requests routed through Durin. For a rollout review, trace the client’s configured endpoint, the authenticated identity, the reviewed connection and tool, the permitted resource, and the resulting activity record.
A successful gateway demonstration is not evidence that every device or direct provider call is covered. Managed client configuration and any required network controls need their own verification. Keep that coverage question separate from the authorization behavior of a request that reaches Durin.
Can a model make the final access decision?
An agent cannot grant itself access or override required checks. Built-in policy enforcement is deterministic. If an administrator opts into TypeSafe AI, the external evaluator can additionally block requests or responses; it cannot override a baseline denial or required independent approval. Uncertain answers and service failures block access.
What happens when a request is denied?
The gateway returns a non-executed denial and records the decision metadata for review. It does not send the denied request upstream.
What happens after a timeout?
A potentially completed write is recorded as uncertain unless a verified provider idempotency mechanism proves the outcome. Durin avoids blindly retrying it.
Does putting a client URL behind Durin prevent bypass?
The gateway governs traffic that reaches it. Managed client configuration and customer network controls must be deployed and independently verified to establish coverage.
Does Durin pass its bearer token to upstream providers?
No. The gateway binds upstream credentials to tenant, requesting identity, provider, scopes, environment, and intended audience. Durin tokens and provider tokens are separate.
Are audit records the full request payload?
Metadata-only retention is the default. Retention, payload inspection, export, and provider handling should be configured and reviewed for the deployment.
What changes when TypeSafe AI is enabled?
The organization can opt into the external TypeSafe evaluator where the server is configured for it. The evaluator receives consumer permissions together with tool request or response content and can further restrict access. Built-in identity, resource, membership, and approval checks remain authoritative.
Review the external data flow before enabling this option. A service failure or uncertain answer blocks access rather than silently allowing the call. Withholding an upstream response does not undo a write that has already happened. Changes to the evaluator invalidate outstanding approvals.
What evidence should I inspect for one action?
Use the identity, connection, tool, resource, argument digest, policy and schema versions, timestamps, decision, and execution outcome that are available for the request. For approval flows, also establish who reviewed the exact action and whether its grant was still valid at retry.
Match evidence to the intended environment and provider. A local or synthetic test demonstrates that test path; it does not establish a live provider’s availability, tenant deployment, or customer network coverage. Metadata-only records should not be described as complete copies of the original request and response.
Where should assurance questions go?
Use the public security and trust material for the declared controls and the evidence needed for your vendor review. Ask for the particular operational, contractual, or independent assurance evidence your organization requires.
Do not infer certification, contractual data residency, an uptime guarantee, or a support commitment from a product feature or a successful policy test. Those claims require their own current evidence and agreement.