12-Layer Security Architecture

ASCEND implements a defense-in-depth security model with 12 distinct security layers. Every layer is designed with fail-secure behavior, meaning any error condition defaults to DENY.

Security Layer Overview

REQUEST → L1 → L2 → L3 → L4 → L5 → L6 → L7 → L8 → L9 → L10 → L11 → L12 → BUSINESS LOGIC
         │    │    │    │    │    │    │    │    │    │     │     │
         ▼    ▼    ▼    ▼    ▼    ▼    ▼    ▼    ▼    ▼     ▼     ▼
        Rate Prmt Code Gov  JWT  API  RBAC BYOK Aud  Val   Sec   Hdr
        Lim  Sec  Anly      Auth Key            Log  Inp   Mgmt

Layer Details

Layer 1: Rate Limiting

Purpose: Protect against DDoS attacks and abuse

Aspect	Detail
Implementation	Redis-backed token bucket
Fail-Secure	DENY on Redis unavailable
Configuration	Per-user, per-org, per-endpoint

Layer 2: Prompt Security

Purpose: Detect and block prompt injection attacks

Aspect	Detail
Implementation	Pattern matching + ML analysis
Fail-Secure	BLOCK on detector failure
Detections	Injection, jailbreak, data exfiltration

Layer 3: Code Analysis

Purpose: Scan code for security vulnerabilities and secrets

Aspect	Detail
Implementation	SAST + pattern matching
Fail-Secure	BLOCK on analyzer error
Detections	Secrets, credentials, dangerous patterns

Layer 4: Action Governance

Purpose: Evaluate AI agent actions against policies

Aspect	Detail
Implementation	Policy engine + CVSS scoring
Fail-Secure	DENY on evaluator error
Decisions	ALLOW, DENY, REQUIRE_APPROVAL

Layer 5: JWT Authentication

Purpose: Verify user identity

Aspect	Detail
Implementation	AWS Cognito + RS256
Fail-Secure	DENY on invalid/expired token
Features	MFA, token refresh, session management

Layer 6: API Key Validation

Purpose: Authenticate API clients

Aspect	Detail
Implementation	Constant-time comparison
Fail-Secure	DENY on validation failure
Features	Scoped permissions, expiration

Layer 7: RBAC Authorization

Purpose: Enforce role-based access control

Aspect	Detail
Implementation	6-level role hierarchy
Fail-Secure	DENY on permission check failure
Roles	Platform Admin, Enterprise Admin, Org Admin, Policy Admin, Analyst, Viewer

Layer 8: BYOK Encryption

Purpose: Customer-managed encryption keys

Aspect	Detail
Implementation	AWS KMS envelope encryption
Fail-Secure	FAIL on key unavailable
Algorithm	AES-256-GCM

Layer 9: Audit Logging

Purpose: Immutable audit trail

Aspect	Detail
Implementation	Hash-chained WORM logs
Fail-Secure	BLOCK if audit write fails
Retention	7 years

Layer 10: Input Validation

Purpose: Sanitize and validate all input

Aspect	Detail
Implementation	Pydantic models + sanitization
Fail-Secure	REJECT malformed input
Coverage	All API endpoints

Layer 11: Secrets Management

Purpose: Secure storage for sensitive configuration

Aspect	Detail
Implementation	AWS Secrets Manager
Fail-Secure	BLOCK on secrets fetch failure
Features	Rotation support

Layer 12: Security Headers

Purpose: Browser security protections

Aspect	Detail
Implementation	FastAPI middleware
Headers	CSP, HSTS, X-Frame-Options, etc.
Default	Restrictive configuration

Fail-Secure Design

Every security layer implements fail-secure behavior:

# Example: Rate Limiting Layer
async def check_rate_limit(request):
    try:
        result = await redis.check_limit(request.user_id)
        return result
    except RedisError:
        # FAIL SECURE: Deny on Redis unavailable
        logger.error("Redis unavailable, denying request")
        return RateLimitResult(allowed=False, reason="Service unavailable")

Multi-Tenant Isolation

Security isolation is enforced at multiple levels:

Level	Mechanism
Database	organization_id on all tenant tables
Authentication	Per-organization Cognito user pools
Authorization	organization_id in JWT claims
API	All endpoints scoped to organization
Encryption	Per-organization BYOK keys
Audit	Organization-filtered audit logs

Verification

All 12 security layers have been verified through automated testing:

• 36 fail-secure tests validating DENY behavior on error
• 29 multi-tenant isolation tests ensuring data separation
• 16 authentication tests verifying identity management
• 21 authorization tests confirming access control