Access Control
SolaceVeil uses closed institutional provisioning, role-aware access, session controls, and authorization boundaries. Public self-service access is disabled unless explicitly introduced for a governed product surface.
Execution Boundaries
Observation and reasoning do not automatically grant execution authority. Consequential actions may require verified state, admitted authority, revocation checks, and explicit operator approval or execution tokens.
Data Protection
Safeguards may include encrypted transport, protected credentials and tokens, environment isolation, provider access controls, logging, backup practices, and least-privilege integration scopes.
Auditability
Access events, governance decisions, admitted evidence, execution posture, integration consent, and relevant operational lineage may be recorded to support investigation and institutional accountability.
Incident Response
Suspected security events are assessed for containment, impact, remediation, preservation of evidence, provider coordination, and legally required notification.
Responsible Disclosure
Report suspected vulnerabilities privately to security@veil.moralclarity.ai. Include the affected surface, reproduction steps, impact, and supporting evidence. Do not access data that is not yours, disrupt services, or publicly disclose an unresolved issue.
Shared Responsibility
Institutions are responsible for lawful use, appropriate operator roles, endpoint security, credential protection, connected-service permissions, and internal governance.