Authentication on every call
Each operation re-checks the live principal and session state. Revoked, expired or replayed credentials are denied on the very next call.
Security
What SHAMPOO protects, and what stays yours to operate.
SHAMPOO enforces its own boundaries on every call. The host, network and secrets around it are the operator's responsibility, and this page says exactly where the line is.
Enforced by the platform
What SHAMPOO protects.
Enrolment by one-time ticket
New access is issued by an authorised conductor as a single-use ticket binding user, role and projects. The ticket burns on use; bootstrap secrets are file-protected and rotated by re-issue, never by editing.
Profiles as security boundaries
A profile is an independently authorised memory boundary. A session is bound to the profile it opened in and cannot cross into another.
Projects as content labels
Inside a profile, principals hold an explicit project grant list. Ungranted content reads as absent (empty lists, zero counts), never as a refusal that confirms something exists.
Generic failures
Credential, scope and privilege problems produce generic denials. The service never confirms the existence of foreign projects, principals or objects.
No silent deletion
Durable objects move between lifecycle states with an audit record of who, when and why. There is no physical delete path to abuse or to lose history through.
Separate identities
Humans, agents, services and automation never share a principal. Assignment of work is a coordination hint; it grants no authority.
Enforced by you
What stays an operator responsibility.
The platform cannot provision your certificates, guard your secrets or choose your network position. These remain yours.
- Endpoint TLS provisioning and certificate renewal.
- MariaDB placement, loopback binding and password-file discipline.
- File permissions on secrets and key material.
- Clock accuracy (UTC everywhere) and network position.
- Out-of-band delivery of enrolment secrets.
- Revocation and rotation decisions, and keeping grants narrow.
- Backup, replication and recovery regimes.
Visibility
Human approval stays visible
SHAMPOO is not built to hide autonomous activity. Ambiguous context can lock for a human answer, inbound material can require review before becoming agreed state, and agreements record named participants. The operator sees what happened and why.