Rigel, its Postgres (chart, vectors, run records, audit) and the optional agent host run in your cloud and network.
RigelSecurity & Trust
Security & Trust
Guardrails for agents that touch production code.
We'd rather show you the mechanisms than a badge. Here's where your data goes, how agents are constrained, what's still on the roadmap and what you own as an operator.
Read-only by default
Agents can't edit their own checks
Data guardrails fail closed
Every run has a budget and a record
On this page · Default posture · Isolation today · Data flows · Guardrails · Disclosures · Compliance · Company
01 · Defaults
Default governance posture.
What's on and off when you install, and who approves what.
| Setting | Default | Who decides |
|---|---|---|
| Impact analysis on PRs | Off; turn it on per repo or per PR | Repo admin |
| PRs that Rigel can merge | Only PRs its own agents open | Rigel, inside your branch protection |
| Human approval | Not required by Rigel; your branch protection decides (we recommend requiring a review) | You |
| Auto-merge on green for supervised flows | On, except bug triage, which never auto-merges | Operator, per flow |
| Upgrade advisors' own auto-merge | Off; turning it on skips the semver and path gates | Operator |
| Major dependency upgrades | Held for a person unless you configure an internal scope and the PR is titled [major] | Operator policy |
| CI and infra paths in dependency PRs | Always refused | Fixed in code |
[needs-review] in a PR title | Always holds the PR | Anyone |
| Code-change auto-merge | Waits for a GitHub Copilot re-review; without Copilot, a person merges | You |
| Agent permission prompts | Off; the tool allowlist is the boundary | Operator, per agent |
| Single sign-on | Off until you configure your identity provider (UI and API are unauthenticated until then) | Operator |
| Confluence publishing | Off (global switch) | Operator |
02 · Data flows
Where your code and data go.
Rigel reads source code to build the chart. Excerpts of that code, and documents derived from it, reach the parties below. You hold the accounts and the keys.
Code excerpts and derived docs go to your model provider and to Voyage AI. GitHub is always connected. Copilot, Slack, Jira and Confluence are your choice.
Your keys, your accounts, your tokens. No platform key sits in the middle.
Who receives what
| Party | Receives | When |
|---|---|---|
| Your model provider (Anthropic API, or Claude through your AWS account) | Code excerpts and derived documents | Always |
| Voyage AI | Doc chunks and code excerpts for embeddings, plus search queries | Always; no alternative today |
| GitHub | Docs PRs, comments, merges | Always |
| Slack, Jira, Confluence | PR events, triage comments, published documents | Only if you connect them |
The full data-flow table
| Service | What it receives | When |
|---|---|---|
| GitHub | API calls and webhooks for repos, PRs, Dependabot alerts and packages | Always |
| Anthropic API or Claude through your AWS account | Code excerpts and derived docs for analysis and agent work. Through your AWS account, model traffic stays in your AWS account. | Always (your choice of provider) |
| Voyage AI | Code-derived text for embeddings, plus users' semantic-search and chat retrieval queries for embeddings and reranking. Sent under your own Voyage key, including when you use Claude through your AWS account. | Always. No alternative embeddings provider today. |
| GitHub Copilot code review | Uses your existing Copilot as the required reviewer for code-change PRs Rigel's agents open | If you use supervised code-change auto-merge |
| Slack, Jira, Confluence | Notifications, issue content, published pages | Optional |
| AWS | Read-only queries in your AWS accounts for ops and release features | Optional |
| Temporal Cloud | Read-only polling of failed workflows | Optional Beta |
A standard DPA is available on request.
03 · Guardrails
What's enforced, and where.
One rule decides how a critic fails. If it protects data, an error blocks. If it protects productivity, an error passes.
Data critics fail closed
error or unsure → BLOCK
Requirement-envelope critic — Checks every outbound agent-to-agent message for concrete sensitive values before any byte leaves. Beta
Knowledge-base leakage critic — Checks every self-learning knowledge-base write. Beta
Quality critics fail open
error or unsure → PASS
Business-language critic — Keeps requirement docs free of prescriptive tech language. An outage never blocks a product owner.
Solution grounding critic — Flags design claims the chart doesn't support. Advisory only.
| Guardrail | What it guarantees | Status |
|---|---|---|
| Read-only surfaces | The analysis agent, MCP tools, AWS tools, chat engine and debug agent expose no mutating tools. | Shipped |
| Guarded sandbox | Code-changing agents work in a fresh clone with a first-token command allowlist, no shell interpreter, lifecycle scripts off, output, time and count caps. | Shipped |
.github/** push ban | Refused at write time, on a pre-push diff and by a git pre-push hook. | Shipped |
| Hardened Postgres boundary | Eight layers for letting agents query sensitive databases, plus error sanitisation and a query audit log. | Shipped |
| Leakage critics | Fail-closed checks on knowledge-base writes and outbound agent-to-agent messages. | Beta |
| Budget caps | USD caps per run, per chat query and per drafting session. Fix loops capped at 4. Organisation-level spend caps Coming soon | Shipped |
| Signed webhooks | HMAC verification for GitHub and Jira. Per-automation secrets on external triggers. | Shipped |
| Record of decisions | Runs, supervisor decision comments, Slack threads, admin access log, agent-to-agent hop log, Postgres query audit. | Shipped · export Coming soon |
Merge approvals
Rigel doesn't require a human approval itself. If your branch protection requires reviews, merges wait for them, and we recommend requiring them.
The upgrade advisors' "auto-merge on green" setting is off by default. When on, it merges through a tool that refuses drafts, changes-requested reviews, unmergeable PRs, PRs with no CI and [needs-review] titles, but it skips the semver and path gates. Leave it off to keep every dependency merge behind those gates.
04 · Agent controls
Safety comes from the tool surface.
Rigel's agents run on the Claude Agent SDK with permission prompts off. Nobody clicks "allow". So every agent gets only the tools Rigel builds for it.
Read-only MCP
Rigel MCP exposes 20 read-only tools. The analysis agent, AWS tools, chat engine and debug agent are read-only too.
Tool allowlists
An agent's tools are what its template declares and what your operator allows. Filesystem tools must be both.
Editing built-ins banned
EditWriteBashWebSearchWebFetchAgent
Banned for every playbook and inline agent, whatever a template declares.
Bash sandbox
A fresh clone, a first-token allowlist (package managers, node, git, unix text tools), no shell interpreter, lifecycle scripts off, 16 KB output, 5-minute max per command, 200 commands.
Allowlisted tools like node can still execute code and reach the network.
.github/** blocked
Refused at write time, on a pre-push diff and by a git pre-push hook. A fixer that thinks a check is wrong files a finding for a human.
Budgets and turn caps
USD caps per run, per chat query and per drafting session, plus turn caps and time limits on every agent loop.
Fixer capped at 4
The PR Supervisor's fix loop stops after 4 rounds. It won't merge while a requested Copilot re-review is outstanding.
Credentials by config
External MCP servers get credentials from their configuration rows, and spawned MCP processes get a minimal environment. Confluence write tools are stripped from every template except a reviewed set.
Agents can't push to the checks that judge them.
An agent's PR is graded by your CI. Editing the CI would mean grading its own homework.
→
Agent edit
touches .github/workflows/ci.yml
1
Write timeThe write is refused.
2
Pre-push diffDiffed against base. Can't compute? Refused.
3
Pre-push hookInstalled in every clone.
◆
Your rulesetA server-side GitHub push ruleset. We recommend it.
✕
GitHubNever reached.
Why the ruleset: a script in the sandbox could, in principle, call the GitHub API with the inherited token and go around the git hook. The ban covers the code-change sandbox, so keep write-capable MCP servers out of agent allowlists.
05 · Sensitive-data boundary
The agent comes to the data.
For data that must never reach the platform, a self-hosted agent host Beta runs next to your database. It's built so only requirement-level answers leave.
- Read-only role with dedicated grants
- Row-level security, tenant set per session
- Read-only transactions
- Statement timeout
- Row cap, with an explicit truncation signal
- Table and function allowlists. DML, DDL and system catalogs rejected
- No multi-statement queries
- Default-deny column redaction before the model sees anything
Plus error sanitisation and an audit log of every query
What the model sees ↓
-- Illustration claim_id status member_name c-1042 in_review [REDACTED] c-1043 in_review [REDACTED] -- truncated: true (row cap)
A host with one database tool
The agent host runs a downloaded, secret-free bundle inside your network. Its only database tool is the boundary on the left. Inbound calls need a shared secret and fail closed.
Strict on the way out
Agent-to-agent messages use a strict schema that rejects extra fields, then pass a fail-closed critic that blocks concrete sensitive values.
Redaction is only as strong as the policy you write, and it can be disabled for development. Never disable it in a sensitive deployment.
06 · Audit trail
Every decision leaves a record.
Runs carry their trigger, cost, tokens, tool calls, findings and deliveries. These records sit in your Postgres.
Decision comments
When the supervisor holds a green PR, it says which gate held it, on the PR.
Slack threads
One thread per PR Rigel's agents open, with 9 lifecycle events.
Admin access log
Admins are read-only. Every cross-user read is logged. Nothing in the app can grant admin.
Run records
Every playbook and supervisor run, its cost, findings and deliveries.
Agent-to-agent hop log
Append-only. Intent and verdict only, never the answer values. Beta
Query audit
Every sensitive-database query is logged, with full errors kept from the agent.
A unified audit export is Coming soon.
07 · Honest disclosures
What's not built yet.
Read these before you deploy. They're the gaps your reviewers would find anyway.
Unauthenticated without single sign-on Today
With your OpenID Connect identity provider configured, every API route needs a valid token, apart from a short documented list. Without it, the API and UI are unauthenticated. That mode is for local evaluation only.
Copilot is the reviewer of record Today
Code-change auto-merge requires GitHub Copilot code review. Without it, post-fix re-reviews never arrive and those PRs wait for a human.
Remote MCP endpoint auth Coming soon
The HTTP transport has no built-in authentication. Keep it inside your network or behind an authenticating proxy.
API rate limiting Not yet
There's no general rate limiting yet. The only limiter guards edit codes on shared drafting sessions.
Guard-railed, not hermetic Today
The code-change sandbox inherits the server's environment, including the GitHub token, model key and database connection string. It isn't network-isolated. Container or microVM isolation is Coming soon.
Per-org SSO and GitHub App Coming soon
Today one install is one trust domain, with a deployment-wide GitHub token and a single read-only admin role.
Hardening roadmap
| Item | Status | Target |
|---|---|---|
| Container or microVM sandbox, scrubbed per-call environment, egress control | Coming soon | Not yet scheduled |
| Short-lived per-installation tokens (GitHub App) in place of one deployment-wide token | Coming soon | Not yet scheduled |
| Remote MCP endpoint auth (OAuth 2.1 / bearer tokens, per-org results, rate limits) | Coming soon | Not yet scheduled |
| Per-org SSO and roles | Coming soon | Not yet scheduled |
| Versioned database migrations | Coming soon | Not yet scheduled |
| General API rate limiting | Coming soon | Not yet scheduled |
| Read-only database role for the stdio MCP server | On our radar | Not yet scheduled |
| Refuse to start in shared mode without identity provider and webhook secrets (explicit dev flag to override) | On our radar | Not yet scheduled |
| Embeddings that stay inside your cloud account | On our radar | Not yet scheduled |
How we recommend exposing Rigel
- App, UI and API behind a private load balancer.
- Only webhook paths on an internet-facing load balancer, with TLS 1.3, a web application firewall, access logs and inbound traffic limited to GitHub's and Atlassian's published webhook ranges.
- Webhooks signature-verified. Set both secrets: without them, checks fall back to development behaviour.
- The MCP server's database connection string carries schema-owner rights today. Treat it as a production credential.
- Container images run as non-root users.
Recommendations, not guarantees. Review against your own policies.
Shared responsibility
What you own as an operator.
Some controls depend on configuration code can't enforce. In a self-hosted install, these are yours.
- Configure single sign-on for any shared deployment.
- Require reviews in branch protection if you want a human on every merge.
- Configure database grants and row-level security for the Postgres boundary.
- Write the column redaction policy for each sensitive database, and never disable redaction there.
- Set the GitHub and Jira webhook secrets.
- Include the untrusted-content instruction in prompts that read retrieved data.
- Connect to sensitive databases with full certificate verification (sslmode=verify-full).
- Keep the MCP HTTP endpoint network-restricted and protect its database connection string.
- Keep write-capable MCP servers out of agent tool allowlists.
- Leave "auto-merge on green" off unless you accept merges without the semver and path gates.
- Add a server-side GitHub push ruleset that protects .github/**.
08 · Compliance status
No badges. Just mechanisms.
Rigel holds no compliance certifications today.
We don't claim SOC 2, ISO 27001, HIPAA or HITRUST. Rigel is built with guardrails for regulated environments, and this page describes each one so your team can evaluate it directly.
Found a vulnerability? Email hello@prismcloudinc.com. We'll acknowledge your report and keep you updated through the fix.
Reports go straight to the engineering team that builds Rigel.
- SOC 2: not certified; no target date set yet.
- ISO 27001, HIPAA: not certified, and we don't claim compliance.
- We'll publish a compliance roadmap once we commit to one.
Security review
Running a security review?
We'll send the architecture overview, data-flow diagram and guardrail detail your reviewers need.
Who's behind Rigel → Company