Marketing, control-plane data, credentials, and execution infrastructure remain separate systems.
Security / authority before autonomy
Software Factory security is a system of boundaries.
byProduct makes scope, identity, tool use, approvals, Tests, and exceptions visible before autonomous work becomes consequential.
Book a scoping callHUMANAUTHORITY
POLICY
EXECUTION
INFRASTRUCTURE
Missing authority, stale context, failed checks, or exhausted budgets stop the work.
Security and compliance claims belong only where their supporting evidence can be inspected.
Control model
Four questions before any consequential action.
Identity and role
Which human, service, or agent initiated the action, and under which role?
ATTRIBUTABLEScope and tool
Which repository paths, systems, data classes, and tools are explicitly allowed?
LEAST PRIVILEGEApproval and expiry
Which action needs human approval, and when does that authority expire?
TIME BOUNDEDTests and evidence
Which exact candidate passed which Tests, review, and residual-risk decision?
EXACT HEADDefault behavior
When authority is unclear, the system stops.
Security is not the promise that the model will make the right judgment. It is the architecture that prevents an uncertain model judgment from silently becoming organizational authority.
- 01Scope missingDENY
- 02Approval expiredDENY
- 03Evidence staleDENY
- 04Owner confirmsRESUME
Security architecture