# Security Overview (docs/architecture/security.md)

Truth document. Use for: the single place the system's security posture is stated — assets, trust boundaries, controls, and accepted risks. Controls link to the code that implements them; this doc asserts, the code proves.

Required: **Trust boundaries**, **Controls**. Optional: Assets, Accepted risks.

```
# Security Overview

## Assets

- {What's worth protecting — data classes, credentials, tenant isolation}

## Trust boundaries

- {Boundary} — {what crosses it, and what checks the crossing} 

## Controls

| Control | Protects against | Implemented in |
| ------- | ---------------- | -------------- |
| {control} | {threat} | `{file/module}` |

## Accepted risks

- {Risk knowingly carried} — accepted because {reason}; owner: {who}. Revisit if: {trigger}.
```