OIDC identity and gateway RBAC
srasta-api validates OIDC JWTs through discovery and JWKS, maps tenant and role claims,
and enforces gateway permissions across inference, RAG, sessions, audit, and admin routes.
Security Review
Srasta's supported single-node deployments keep the local inference, retrieval, admin, audit, and backup paths in the customer's environment. Hosted licensing and optional operational telemetry are separate outbound services; an operator can also configure external model providers. Review these boundaries before choosing a pilot workflow.
These are grounded in the current codebase and deployment artifacts, not just roadmap intent.
srasta-api validates OIDC JWTs through discovery and JWKS, maps tenant and role claims,
and enforces gateway permissions across inference, RAG, sessions, audit, and admin routes.
Internal services can run in forwarded-auth mode. The gateway signs X-Srasta-*
principal headers with HMAC-SHA256 and a short timestamp window so downstream services can verify
that identity context came from the gateway.
Gateway and RAG audit writers record structured JSONL events with request correlation and SHA-256 chain hashes. The chain can be verified to detect log tampering.
Governed Tool Packs will ship only as certified deployment-profile extensions with explicit approval, policy, and audit contracts. They are not part of the active GTM kernel.
Admin telemetry is intentionally allow-listed to counts and deployment shapes. The daemon explicitly excludes prompts, responses, retrieved documents, audit-log content, secrets, stack traces, hostnames, and customer infrastructure IPs.
The srasta-security engine checks for disabled auth/RBAC, weak internal secrets,
default MinIO/Postgres credentials, rate-limit posture, exposed admin ports, license expiry, and
package vulnerabilities.
Inference routes through the customer deployment. Srasta supports local vLLM (GPU) and host-native MLX (Apple Silicon) paths with OpenAI-compatible routing, so security teams can review model access and routing inside their own environment.
Installer and control-plane APIs cover topology, handoff credentials, backup sets, backup verification plans, restore plans, rollback plans, and recovery readiness signals.
Admins manage users, roles, runtime health, licenses, config, release identity, support bundles, and operational telemetry status from the customer-controlled install.
Gateway, RAG, and admin events provide an evidence path for model access, authorization decisions, authentication failures, and rate limits. Governed tools and long-term memory remain planned capabilities.
Start with these maintained public pages. Ask us for current controls evidence or a questionnaire response tailored to your review.
Not ready for a pilot yet?
Some teams need a specific control, integration, export, approval workflow, or review artifact before they can sponsor a pilot. Send us that signal now, or subscribe for product and security updates while you evaluate.
Srasta has not completed SOC 2 attestation yet. We can provide current controls evidence and discuss the attestation plan during a security review. Do not treat a target date or an earlier questionnaire as an issued report or a verified control.