What CORE enforces, and what it does not claim.

Nothing in CORE is reachable except through a named capability. There are no generic read or write endpoints and no table-level access. A capability has a typed input, a permission check and an event, so the surface that needs protecting can be listed.

identity.current() runs before any permission check. Unauthenticated requests resolve to a public actor that can invoke only public read capabilities. Sessions are opaque tokens stored hashed on the server and carried in an HttpOnly, SameSite cookie.

Every capability invocation emits an event with the actor, capability, resource and outcome, written in the same transaction as the change. Events are never edited or deleted; a correction is a new event.

Agents hold their own identity and scoped permissions and reach CORE only through capabilities. An agent cannot widen its own scope: permission.grant is privileged and requires a human role or approval.

In production 2finity.com is served over TLS with HSTS. Responses carry nosniff, a strict referrer policy, X-Frame-Options DENY and a Content Security Policy that forbids framing, restricts base URIs and form targets and blocks plugins. Public pages are static and contain no personal data.

Identity resolution is one interface with one implementation today. 2finity Identity as an OpenID Connect provider is planned; enterprise deployments will plug in their own provider at the same point.

This is the first version of 2finity.com. The following are not in place, and nothing on this site should be read as claiming otherwise.

• No self-service sign-up; accounts exist by invitation only.
• No two-factor authentication.
• No password reset flow; an invited person sets a password once through the invitation link.
• No script-src Content Security Policy; the policy covers framing, base URIs, form targets and objects only.
• No certifications, compliance attestations or uptime figures.