Guides
Secure an Arcwell workspace
Apply least privilege to producers, workers, operators, and deployment automation.
Access model
| Role | Can | Cannot |
|---|---|---|
| producer | Publish allowed signals | Read streams |
| worker | Claim and settle deliveries | Change routes |
| operator | Inspect and replay | Manage owners |
| owner | Manage workspace policy | Cross workspace boundary |
Rotate access keys
Issue
Create a second key with the same narrow role.
Deploy
Update the consumer and verify traffic on the new key.
Revoke
Revoke the prior key after the overlap window.