Identity & access
Authenticate API traffic, manage workspace access, and rotate tenant credentials from a controlled surface.
Security & trust
Controls for operating AI inside a clear tenant boundary.
LiyaEngine combines identity, isolation, policy enforcement, and execution evidence so teams can make deliberate decisions about how AI reaches production.
Control pathSecurity is part of the request lifecycle
01 / AUTHAPI identity
02 / SCOPETenant boundary
03 / GOVERNPolicy checks
04 / EVIDENCEAudit + trace
POST /v1/rundomainintentinputAuthenticatedProduction requests enter through tenant-scoped credentials.
GovernedInput and output policies can run in the execution path.
TraceableOperational evidence connects configuration and runtime decisions.
Control surfaces
Defense in depth without hiding responsibility.
Platform controls help teams enforce boundaries, while application owners remain responsible for their data, policies, access, and deployment choices.
Tenant isolation
Scope domains, knowledge, configuration, sessions, and operational data to the owning tenant.
Data controls
Configure retention, storage consent, memory, and knowledge access for the workload being operated.
Provider boundaries
Keep provider credentials and model strategy in tenant configuration instead of application source code.
Shared responsibility
Secure the capability across its full lifecycle.
Security starts before the first request and continues through configuration changes, runtime execution, and incident response.
01
Classify the data
Decide what the capability may receive, retrieve, retain, and return.
02
Restrict access
Scope people, credentials, domains, collections, and provider connections.
03
Enforce policy
Run validation and guardrail checks in the request path.
04
Review evidence
Use audit and trace records to investigate behavior and improve controls.
Operating principles
Make the production boundary understandable.
Strong platform UX makes ownership, behavior, controls, and evidence visible to the people responsible for the capability.
01
No training claim
Customer API data is not presented as training material for LiyaEngine models.
02
Explicit configuration
Retention, memory, retrieval, tools, and model access should be configured for the workload.
03
Responsible disclosure
Security reports can be sent to [email protected] for coordinated investigation.
Questions
Useful context before you build.
Does LiyaEngine replace application security review?+
No. LiyaEngine supplies platform controls, but customers remain responsible for application design, authorization, data classification, and safe integration.
Can credentials be rotated?+
Yes. Tenant API and provider credentials are managed outside application code and can be rotated through their management surfaces.
How should I report a vulnerability?+
Email [email protected] with reproduction steps, expected impact, and any supporting evidence. Avoid accessing customer data or disrupting production systems.
Design the control boundary before production traffic.
Map identity, data, policies, and evidence to the capability your team is preparing to ship.