CodeGraph connects work on source code, models, and repositories with access control, content checks, and security events. The security team can trace who performed an action, identify data sent to the selected model provider, and find the corresponding event in the SIEM.
This brief helps security leaders, architects, and procurement teams choose pilot settings and find detailed guides. Start with three decisions: who can access projects, where data goes, and which events the SOC needs. Validate those decisions with one representative workflow and retain the results for acceptance.
Trust boundaries
Identify at least these boundaries in the customer design:
- users, service accounts, agents, and their client interfaces;
- API, MCP, ACP, gRPC, dashboard, and CLI entry points;
- PostgreSQL, OpenViking, GoCPG, project files, and generated evidence;
- model providers, repository providers, issue systems, SIEM, and webhooks;
- customer ingress, egress, TLS, secrets, backups, and administrative access.
For each interface, record the user or service account, target project, and allowed actions. Check that the server permits the selected action for that identity and rejects actions outside its permissions.
Identity and authorization
The OAuth and LDAP guide describes corporate sign-in and role mapping. RBAC explains local permissions, API keys, and access to projects.
Map external identities to CodeGraph roles so corporate sign-in leads to the intended permissions. For the pilot, assign administrator and regular-user roles and exercise allowed and denied actions. Then revoke access and check a previously issued session. Agree on token lifetime and revocation with the identity-system owner.
Data and model egress
DLP describes content checks before a model call and after its response. When enabled, the scanner applies configured rules, including request blocking or masking matching content. This gives the team a place to apply sensitive-data rules at the model boundary.
LLM security traces prompt data to the selected provider. Record the model, request content, network route, retention, and logging settings. Include an external provider’s data-processing terms in the connection decision. Exercise a DLP rule with synthetic data and compare the observed result with its configured action.
Keep secrets out of prompts, logs, configuration committed to source, fixtures, and public documentation. Apply customer classification and retention rules to generated reports and evidence.
Security events and audit
SIEM integration adds CodeGraph events to the SOC investigation stream. Syslog, CEF,
and LEEF send events over UDP, TCP, or TLS. The dispatcher supports multiple handlers and a retry
queue. The request_id field connects an event to its request. Run the published sending example,
find the receiver record, and compare identifiers.
Define required event types, severity mapping, retention, receiver ownership, alert routing, delivery SLO, degraded-mode policy, and reconciliation procedure for the pilot.
Deployment and operations
Use the deployment guide to choose a profile and its installation files. Record the exact version, service status, secret management, and network controls. Test backup, restore, and rollback on your configuration.
Assign an owner to each platform component, including the services maintained by your organization. Size the environment from the pilot corpus and measured service objectives.
Governed delivery
Governed delivery connects a change to requirements, its task, accountable reviewers, and results for a specific revision. The security team can follow that chain from the reason for a change to the decision to release it.
Collect QA, AppSec, representative-workflow, recovery, and operations results before acceptance. Record the approved action and its scope. Compare the status page with current review results so the team makes its release decision against one revision.
Evidence to request
For a pilot or RFP, request evidence appropriate to the actual profile:
- threat model and data-flow diagram with provider and storage boundaries;
- identity, RBAC, service-account, session, and deprovisioning tests;
- DLP positive, negative, masking, and provider-call evidence;
- secret, dependency, source, and publication scans for the immutable release;
- SIEM dispatch, buffer, downstream receipt, and alert-recovery evidence;
- installation, health, representative workflow, backup, restore, and rollback results;
- review findings, selected measures, owners, and due dates;
- QA, AppSec, documentation, support, and operations findings tied to the reviewed revision.
For each result, record what was checked, where, against which revision and configuration, by whom, and with what conclusion. This package helps the team approve the pilot, reproduce the checks, and compare the next release with the accepted decision.
Maintain the accepted configuration
Repeat the relevant checks after changing configuration, providers, network topology, or interfaces. For regulatory requirements and standards, use the relevant documents and a separate assessment.