# Security

URL: /workflows/processes/security · Id: `process:security`

> Security keeps every Permission earned, every secret fresh, and every access recorded.

Security keeps every [Permission](/business/nouns/permission) earned, every secret fresh, and every access recorded.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Every Role holds only the Permissions it used in the last 30 days, and no secret is older than 90 days. |
| Reads | [Role](/business/nouns/role), [Permission](/business/nouns/permission) |
| Leaves | [Permission](/business/nouns/permission), [Decision](/business/nouns/decision) |
| Runs in | Each Startup |

## Accountable
[Engineering Lead](/agents/engineering/engineering-lead), [Engineering Team](/agents/engineering).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Access review](/workflows/processes/security/access-review) | every day | [Engineering Team](/agents/engineering) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Access review](/workflows/processes/security/access-review) | 1. List each Role’s Permissions. | [Security Engineer](/agents/engineering/security-engineer) | [Permission.list](/business/nouns/permission/list) | None |
| [Access review](/workflows/processes/security/access-review) | 2. Compare them with the Verbs the Role called in the last 30 days. | [Security Engineer](/agents/engineering/security-engineer) | [Action.list](/business/nouns/action/list) | None |
| [Access review](/workflows/processes/security/access-review) | 3. Remove Permissions unused for 30 days. | [Security Engineer](/agents/engineering/security-engineer) | [Permission.delete](/business/nouns/permission/delete) | None |
| [Access review](/workflows/processes/security/access-review) | 4. Rotate secrets older than 90 days. | [Security Engineer](/agents/engineering/security-engineer) | [Secret.rotate](/business/nouns/secret/rotate) | None |
| [Access review](/workflows/processes/security/access-review) | 5. Report every widened Permission to the Founder. | [Security Engineer](/agents/engineering/security-engineer) | [Message.create](/business/nouns/message/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | Every day | Starts [Access review](/workflows/processes/security/access-review) |
| Out | `Permission.deleted` | Raised by step 3 of [Access review](/workflows/processes/security/access-review) |
| Out | [`Secret.rotated`](/business/events/Secret.rotated) | Raised by step 4 of [Access review](/workflows/processes/security/access-review) |
| Out | `Message.created` | Raised by step 5 of [Access review](/workflows/processes/security/access-review) |

## Plays
No Play names this Process.

## Controls
- [Action accountability](/systems/trust-and-governance/controls/action-accountability)
- [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions)
- [Task-bound access](/systems/trust-and-governance/controls/task-bound-access)
- [Permission decay](/systems/trust-and-governance/controls/permission-decay)
- [Permission widening](/systems/trust-and-governance/controls/permission-widening)
- [Unseated access](/systems/trust-and-governance/controls/unseated-access)
- [Secret rotation](/systems/trust-and-governance/controls/secret-rotation)
- [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation)
- [Encryption](/systems/trust-and-governance/controls/encryption)
- [Boundary protection](/systems/trust-and-governance/controls/boundary-protection)
- [Vulnerability management](/systems/trust-and-governance/controls/vulnerability-management)
- [Append-only records](/systems/trust-and-governance/controls/append-only-records)

## Settings
| Setting | Type | Default | Say | Set with |
| --- | --- | --- | --- | --- |
| `access.unusedDays` | `integer` | `30` | Remove permissions unused for 30 days | [Setting.update](/business/nouns/setting/update) |
| `secrets.maxAgeDays` | `integer` | `90` | Rotate secrets every 90 days | [Setting.update](/business/nouns/setting/update) |

## Failure
A failed step retries; when retries run out, the Action goes to the [Engineering Lead](/agents/engineering/engineering-lead).

## Loop
No loop: the path is never randomized, because it serves [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions).

## Code

**Ask**

```text
Turn on security
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

**Ask**

```text
Remove permissions unused for 30 days
```

**API**

```bash
curl -X PATCH https://api.sb/leaseline.app/settings/setting_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":30,"key":"access.unusedDays"}'

curl -X PATCH https://api.sb/leaseline.app/settings/setting_2 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":90,"key":"secrets.maxAgeDays"}'
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Setting.update({ id: 'setting_1', value: 30, key: 'access.unusedDays' })
await $.Setting.update({ id: 'setting_2', value: 90, key: 'secrets.maxAgeDays' })
```

**CLI**

```bash
npx startup-builder do Setting.update --json '{"id":"setting_1","value":30,"key":"access.unusedDays"}'
npx startup-builder do Setting.update --json '{"id":"setting_2","value":90,"key":"secrets.maxAgeDays"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "await $.Setting.update({ id: 'setting_1', value: 30, key: 'access.unusedDays' })\nreturn await $.Setting.update({ id: 'setting_2', value: 90, key: 'secrets.maxAgeDays' })"
  }
}
```

## Example
On the 1st, [Access review](/workflows/processes/security/access-review) finds a candidate-matching [SaaS](/products/templates/saas)'s [Prospector](/agents/sales/prospector) [Role](/business/nouns/role) has not deleted a [Contact](/business/nouns/contact) in 30 days. The Permission is removed, and the [Founder](/agents/founding/founder) reads the report.