Enterprise activation
Configure and verify Ductor's fail-closed enterprise security profile.
Set security_profile: enterprise to enable Ductor's fail-closed production
security posture. The process validates every required control at startup and
refuses to serve traffic when a required dependency or setting is missing.
The enterprise hardening posture
security_profile: enterprise applies a fail-closed posture after static config
loads, and the process will not start unless the required knobs are set
explicitly:
| Requirement | Setting |
|---|---|
| Fail-closed authorization | authz.allow_when_unconfigured=false |
| Enforced egress | egress.mode=enforce |
| Durable marketplace with signature verification | marketplace.enabled=true + artifact_verification trusted keys |
| Real connector master-key source | connector.encryption_key or key_provider.enabled=true with wrapped_master (KMS/Vault) |
| Exec fails closed | server.exec_isolation_required=true (in-process exec fails until a real isolated runner is wired) |
| Workflow-runtime safety limits | nonzero tick timeout, CAN thresholds, transition and run-state caps |
| Loopback-bound metrics | metrics listener bound to loopback (also part of the Helm production gate) |
| Cross-replica aggregator | aggregator.backend=redis |
Switch the aggregator to redis before production
aggregator.backend=memory (the default) is in-process only: it loses every
deferred slot on restart and does not coordinate across replicas. Enterprise
requires redis, and you should switch to it before flipping the
aggregator on in any multi-replica production deployment — not after.
See Security & auth for the individual controls and Key management for the master-key source.
Verify the profile before rollout
Enable the profile in a non-production environment first and confirm that the service starts with the same secret, Redis, marketplace-signing, metrics, and execution-isolation configuration you will use in production. A startup failure identifies the missing or unsafe setting; correct the configuration instead of disabling the profile.
After startup, check readiness and exercise an authenticated, tenant-scoped request before admitting traffic. See Health checks for probe behavior and Production deployment for rollout guidance.
Related
Durable Route Runtime
Journal payload budgets, transition-history compaction, dual-stream archival, and the reliability safety nets that keep run history bounded and secret-free.
Certified Promotions & Rollout
The governed release control plane for config and strategy artifacts — promotion candidates, rollout-evidence packs, and runtime-conformance gates.