AutoCore Security Responsibility Matrix
Maps product, operator, provider, and host responsibilities across the security boundary.
Security is shared across the application, deployment, providers, and operating environment. The matrix prevents a source-level control from being mistaken for an operational guarantee.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| AutoCore source | Auth, authorization, state validation, provider adapters, audit calls, safe health output, and feature gates. |
| Deployment operator | Secrets, host, proxy, DNS, TLS, backups, restore authorization, monitoring, access, and retention. |
| Provider | Hosted payment/email/SMS delivery, webhook platform, domain verification, provider-side logs, and availability. |
| Release owner | Source identity, artifact checksums, SBOM review, validation evidence, and promotion decision. |
| Legal/accountable organization | Policy content, identity accuracy, privacy decisions, notices, and jurisdictional obligations. |
High-risk operation
Use explicit authorization, a written reason, a confirmation gate, and post-action verification. Documentation does not grant permission to change a deployment.
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.