The AI never holds the keys. And never gets the last word.
How DevPlus protects your clouds, your credentials, and your tenants.
Policy on every action, deny by default
A dedicated governance service embeds Cedar, the open-source authorization language created by AWS. Authorization only succeeds when a permit policy matches; with zero policies loaded, everything is denied.
Every API request is policy-checked
Each named route is a Cedar action. The request context includes the caller's role, per-project group permissions, project tags and attributes, and the current hour and day of week, so “no production deploys on weekends” is one policy.
A policy gate between plan and apply
After OpenTofu plans the change, but before anything is applied, Cedar evaluates the plan with its estimated monthly cost, resource change count, and whether any resource would be destroyed and recreated. A denial stops the run before apply, every time.
Denials name the policy
A blocked request returns the blocking policy by name, and a blocked deployment lands in a dedicated policy_blocked status with the reasons in its log, never a generic 403.
The AI is governed too
Each of the seven agents acts under its own Cedar principal with a seeded least-privilege policy, and every deployment an agent triggers passes the exact same plan gate a human's would. There is no AI bypass lane.
Human approval, cryptographically anchored
The AI never acts silently. Every state-changing agent action pauses on an interactive approval card, parameters visible and editable, and only continues on an explicit approval.
Approval hashes
The exact payload a human approved is canonicalized and hashed, and the hash is recorded with the action, so an approval can later be matched to precisely what executed, not a paraphrase of it.
A durable audit trail
The agent-actions log records the agent, action, resource, outcome, the authorizing user, and the approval hash, and is designed to survive the deletion of the deployments it describes.
Edited approvals are untrusted input
When a user edits an AI-proposed design or parameter set, the edited payload is re-validated server-side with the same deterministic rules before anything runs.
Preview before commit
Any deployment can run as a plan-only preview: a real tofu plan plus a cost estimate in an isolated job pod, with nothing applied.
Keyless cloud access
Each tenant runs its own OIDC issuer: a standards-compliant identity provider with RS256 signing and RFC 7638 key thumbprints. External clouds federate against its public JWKS, so cloud access needs no stored keys.
AWS without access keys
For each run, DevPlus mints a one-hour deployment-scoped token and exchanges it via STS AssumeRoleWithWebIdentity against your own IAM role. The trust policy pins a per-connector subject, so one role maps to exactly one connector.
CloudTrail attribution built in
The STS role session is named after the deployment, so every AWS API call in your CloudTrail traces to a specific DevPlus deployment.
Azure federation
Azure connectors support OIDC client-assertion federation, managed identity, or classic service principal, including sovereign clouds. Federated is the recommended path.
No passwords where it counts
MongoDB Atlas is reached via OIDC workload identity (no database passwords), the AI layer authenticates with short-lived workload-identity tokens rather than stored API keys, and services authenticate to each other with platform-minted JWTs exchanged through the Kubernetes TokenReview API.
Tenant isolation you can diagram
One tenant equals one Kubernetes namespace, one MongoDB database, one WorkOS identity organization, and one cryptographic scope.
Isolation enforced by ciphertext
Managed secrets and OpenTofu state are envelope-encrypted with AES-256-GCM under per-tenant derived keys, with the tenant bound as authenticated data. A blob sealed for one tenant fails authentication if opened under another.
Single-use execution pods
Every plan, apply, and discovery scan runs in its own single-use Kubernetes job pod with an ephemeral workspace, destroyed minutes after the run. Nothing lingers between runs.
Sessions that can't cross tenants
The browser holds only a sealed, HttpOnly session cookie, with no tokens in localStorage. Every token is bound to the tenant's identity organization; a valid session from another tenant is rejected and evicted. Mutations require an explicit CSRF header.
Enterprise SSO, self-service
Admins mint single-use WorkOS Admin Portal links from inside DevPlus to configure SAML/OIDC SSO and domain verification for their own organization. No support ticket.
Found something?
We welcome coordinated disclosure. Our security contact is published at /.well-known/security.txt.