Remote content is untrusted.
Remote sites do not gain access to TAHAI privileged services merely because they are open in the browser.
Security architecture
Privilege must be narrow, explicit, and auditable.
Security work is being completed before packaging. TAHAI privileged services are isolated from remote sites, WebUI payloads require validation, and generic command or secret-retrieval interfaces are prohibited.
Local IDs do not grant authority.
Mission references, service links, and local identifiers never grant access to TAHAI services or third-party providers.
Server authorization stays server-side.
IT Docs and PSA operations remain server-authorized. The browser is not an authentication authority and does not directly call PSA providers.
Prohibited interfaces
No generic power surface.
Browser-native tools must use narrow contracts, validated payloads, explicit permissions, and an audit trail.
Generic command executionProhibited
Secret-retrieval APIsProhibited
Cookies or token export to evidenceProhibited
Authorization-header captureProhibited
Raw browser-storage dumpsProhibited
Credential storage for TAHAI servicesProhibited
Managed policy
Enterprise governance is a release gate.
The source includes a managed policy framework plus Windows Registry and GPO scaffolding. Protocol, extension, permission, diagnostics, privacy, and provenance evidence must pass before packaging proceeds.
Policy inputs
- Managed policy framework
- Windows Registry scaffolding
- GPO policy scaffolding
- Active policy truth in diagnostics
Profile boundaries
- Profile-scoped feature services
- Storage and permission separation
- Mission references without authority
- Explicit privileged-service boundaries
Next governance pass
- Extension allow and block policies
- External protocol handling
- Dangerous scheme blocking
- Permission governance and audit
Disclosure
Security reports should be handled privately.
Do not publish credentials, tokens, private customer data, or exploitable details in public issues. Use the contact path provided through TAHAI Web Services for responsible disclosure.