Kloom authenticates with OAuth 2.0 and PKCE. API scopes map directly to surface areas — a credential granted the resolve scope cannot call ingest endpoints. Scope violations are rejected at the gateway layer, not the application layer.
Credentials are never sent in query strings or logged. Revocation is synchronous.
Authorisation is enforced at multiple layers. The four controls below compose — a mission-isolated deployment with per-corpus partitioning and gateway-level scope enforcement is the standard configuration for multi-tenant or multi-jurisdiction environments.
Roles are scoped at the mission level. A resolver assigned to one mission cannot read or write corpus partitions belonging to another, regardless of any broader role assignment.
Multiple missions run against a single Kloom instance, each with its own corpus partition, session namespace, RBAC scope, and audit-log segment. Missions share the matching engine — nothing else.
Evidence ingested under one corpus partition is invisible to queries operating under any other partition, even within the same mission. Partition assignment is set at ingest time and is immutable.
OAuth scopes map to surface areas: ingest, resolve, query, curate, audit. A machine credential with the resolve scope cannot call ingest endpoints. Enforcement is at the gateway — before the request reaches the application.
Every deployment generates a structured JSON operational log — every API call, resolution event, session open, and curator action. The schema is versioned and SIEM-exportable.
A second forensic stream is sealed with a chain hash per segment — appending an entry rehashes the chain, and any post-hoc modification breaks it detectably. This is the stream you hand to an auditor.
Kloom operates a coordinated disclosure policy. Report issues to security@kloom.ai before publishing. We do not pursue legal action against researchers acting in good faith under this policy.
Acknowledgement within 2 business days. Triage decision within 10. Critical-severity issues receive out-of-band patches on a timeline agreed with the reporter before public disclosure.
Security reviewers and procurement teams can request an architecture briefing, a pre-deployment review, or the current threat-model documentation. Reach us at security@kloom.ai.