Compatibility: Pactmark 0.1.x.

​
Secrets

Figure 1. Pactmark issues opaque, short-lived, purpose-bound references only after authority and policy succeed. The target adapter resolves the value immediately before invocation and never persists it. Your responsibilities on either side of that corridor:

Store secrets in a host-managed secret system

Not in environment variables baked into an image, and not in your repository.

Never persist or emit the resolved value

Including in retry wrappers, error messages, HTTP client debug logs and crash dumps.

Bind credentials to origins

A credential issued for one origin must not be usable against another.

Rotate on a schedule and on incident

And verify old references resolve zero times afterwards.
Redaction is enforced before export, not configured in a dashboard. If you add your own telemetry exporter, you have added a surface that redaction canaries must cover — see threat model row TM-17.

​
Egress

Route all external traffic through an injected egress broker with:
Model or tool content cannot select an undeclared endpoint. That is the property the whole design protects — see threat model row TM-10.
DNS rebinding and network-provider behaviour still need deployment controls. An allowlist of origins is a strong control; it is not a substitute for network segmentation.

​
Regions and residency

Pactmark does not choose a region and does not promise residency. What it does is make you write the claim down in a digested profile:
Because these become part of modelSecurityProfileDigest, changing them is a visible identity change rather than a silent configuration edit.

​
Record the data path of every system

Not just the obvious ones:

Host runtime

Where the process executes.

Database

Primary, replicas and their regions.

Artifact store

Including any CDN in front of it.

Model provider

Processing region, retention, logging and training posture.

Tool targets

Every allowlisted origin is a data path.

Logs and telemetry

Where they are stored and who can query them.

Backups

Region, retention and restore access.

Support tooling

The one people forget. Support access is data access.

​
Observability without leakage

Telemetry is opt-in and metadata-only by default. Record stable event type, duration, bounded counts, status and opaque digests. Do not record: prompts, completions, workspace bodies, tool arguments or results, credentials, challenge proofs, protected context, or hidden reasoning. Keep application logs, audit records, work state, telemetry and evidence as distinct outputs with separate access and retention. They answer different questions for different audiences, and merging them into one stream means the strictest policy is being violated somewhere.

​
Retention and deletion

Define retention independently for each record type: events, commands, work orders, protected context, inputs, effect ledgers, approvals, artifacts, verification, evidence, audit, logs, telemetry, projections, replicas and backups.
Append-only run truth does not mean indefinite retention. Deletion must be tenant-scoped, authorised, idempotent and observable — and you must rebuild or remove projections after source deletion. Track backup expiry and legal holds honestly rather than claiming immediate erasure where the storage system cannot provide it.
Verify deletion across primary, replica, backup, artifact and telemetry systems. A deletion that only ran against the primary is not a deletion.

Responsibility matrix

Which of these lines Pactmark helps with, and which are entirely yours.

Security model

The control set these operational rules derive from.