<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="eli.ai" agent="eli.ai diagram exporter" version="1">
  <diagram id="api-key-paths-two-different-security-models-1f49ca21" name="API-key paths: two different security models">
    <mxGraphModel dx="1600" dy="1200" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1600" pageHeight="1200" math="0" shadow="0">
      <root>
        <mxCell id="0"/>
        <object id="1" label="API-key paths: two different security models" schemaVersion="1" diagramId="api-key-paths-two-different-security-models-1f49ca21" canonicalAppearanceKey="md:docs/architecture/security-and-controls.md#3" sourceSha256="1f49ca213e902e4b9b7d8bb10769f6fc374138103031fbe58b7575c57d0ca996" metadataPayloadSha256="ec67694b5f18c268b4368f6a837319e95fec199103db85d0875c37cfd6eb5960" generationKey="d90414aefd1c7fb4d3441cde7540c6ae0df7ef5104fa65624fd59929cfe2fa6e" concepts="[&quot;Security and controls&quot;,&quot;API-key paths: two different security models&quot;]" keywords="[&quot;API scope gate&quot;,&quot;withWorkspace + RLS&quot;,&quot;Workspace key lookup&quot;,&quot;User key lookup&quot;,&quot;SHA-256 hash match&quot;,&quot;Authorization: Bearer key&quot;,&quot;Fixed workspace + stored scopes&quot;,&quot;Optional path workspace equality&quot;,&quot;Live user membership recheck&quot;,&quot;All workspaces or key allowlist&quot;,&quot;Resolve live role capabilities&quot;,&quot;Filter stored scopes by live authority&quot;,&quot;Stored scope + exact operation capability&quot;,&quot;eli_sk_&quot;,&quot;eli_uk_&quot;,&quot;Prefix&quot;]" application="{&quot;name&quot;:&quot;eli-ai&quot;,&quot;version&quot;:&quot;0.1.0&quot;}" packages="{&quot;mermaid&quot;:&quot;11.16.0&quot;,&quot;mermaidCli&quot;:&quot;11.16.0&quot;,&quot;playwright&quot;:&quot;1.62.1&quot;,&quot;playwrightCore&quot;:&quot;1.62.1&quot;,&quot;puppeteer&quot;:&quot;25.6.0&quot;,&quot;puppeteerCore&quot;:&quot;25.6.0&quot;}" environment="{&quot;architecture&quot;:&quot;x64&quot;,&quot;containerImage&quot;:&quot;playwright:v1.62.1-noble@sha256:c091b21d9fae78c76e85cd4356431e9b018402f172a214fc7d7a5e9a7e29d8ac+node:26.3.1-bookworm-slim@sha256:209558c3e5e40e8adff68959d3c2ba7cd73723e716d89196878a0c362fa1e109&quot;,&quot;node&quot;:&quot;v26.3.1&quot;,&quot;platform&quot;:&quot;linux&quot;,&quot;yarn&quot;:&quot;4.17.1&quot;}" renderer="{&quot;browser&quot;:{&quot;executableSha256&quot;:&quot;0b20b130e7edd9dd51873be867761295fe0cfad490c2b9a64f95bd3cfc08fa71&quot;,&quot;name&quot;:&quot;chromium&quot;,&quot;revision&quot;:&quot;1234&quot;,&quot;version&quot;:&quot;151.0.7922.34&quot;},&quot;font&quot;:{&quot;family&quot;:&quot;Eli Diagram Inter Variable&quot;,&quot;fileSha256&quot;:&quot;3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62&quot;,&quot;licenseSha256&quot;:&quot;3b0a5fca3d17942cde889069889dedbbbd075e9b599968c82a95f4d944e9b345&quot;},&quot;mermaidConfigSha256&quot;:&quot;68c10966fe84406ee626034d58bfabd555df9f65f691204b7c46db24038da101&quot;,&quot;themeCssSha256&quot;:&quot;c80287a78d80ad63d27bd5ca348b2ef9a7e2f44da289e436be6484ea28a1b033&quot;}" adapterVersions="{&quot;diagramGenerator&quot;:&quot;2&quot;,&quot;drawioFlowchart&quot;:&quot;1&quot;,&quot;drawioGantt&quot;:&quot;1&quot;,&quot;drawioSequence&quot;:&quot;1&quot;,&quot;drawioState&quot;:&quot;1&quot;}" mermaidType="flowchart" direction="TD" generatedAt="2026-08-12T23:36:42.923Z" mermaidSource="flowchart TD&#10;    H[Authorization: Bearer key] --&gt; P{Prefix}&#10;    P --&gt;|eli_sk_| WK[Workspace key lookup]&#10;    P --&gt;|eli_uk_| UK[User key lookup]&#10;&#10;    WK --&gt; WH[SHA-256 hash match]&#10;    WH --&gt; WS[Fixed workspace + stored scopes]&#10;    WS --&gt; WM[Optional path workspace equality]&#10;    WM --&gt; WG[API scope gate]&#10;&#10;    UK --&gt; UH[SHA-256 hash match]&#10;    UH --&gt; UM[Live user membership recheck]&#10;    UM --&gt; UA[All workspaces or key allowlist]&#10;    UA --&gt; UC[Resolve live role capabilities]&#10;    UC --&gt; UE[Filter stored scopes by live authority]&#10;    UE --&gt; UG[Stored scope + exact operation capability]&#10;&#10;    WG --&gt; RLS[withWorkspace + RLS]&#10;    UG --&gt; RLS">
          <mxCell parent="0"/>
        </object>
        <object id="n:H" label="Authorization: Bearer key" mermaidId="H" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="165.546875" y="8" width="246.90625" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:P" label="Prefix" mermaidId="P" mermaidShape="diamond">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;perimeter=rhombusPerimeter;shape=rhombus;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="241.578125" y="110" width="95.84375" height="95.84375" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:WK" label="Workspace key lookup" mermaidId="WK" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="22.007813" y="519.84375" width="227.984375" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UK" label="User key lookup" mermaidId="UK" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="352.882813" y="279.84375" width="178.234375" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:WH" label="SHA-256 hash match" mermaidId="WH" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="27.65625" y="645.84375" width="216.6875" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:WS" label="Fixed workspace + stored scopes" mermaidId="WS" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="8" y="759.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:WM" label="Optional path workspace equality" mermaidId="WM" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="8" y="885.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:WG" label="API scope gate" mermaidId="WG" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="50.96875" y="1023.84375" width="170.0625" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UH" label="SHA-256 hash match" mermaidId="UH" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="333.65625" y="405.84375" width="216.6875" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UM" label="Live user membership recheck" mermaidId="UM" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="314" y="507.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UA" label="All workspaces or key allowlist" mermaidId="UA" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="314" y="633.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UC" label="Resolve live role capabilities" mermaidId="UC" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="314" y="759.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UE" label="Filter stored scopes by live authority" mermaidId="UE" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="314" y="885.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:UG" label="Stored scope + exact operation capability" mermaidId="UG" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="314" y="1011.84375" width="256" height="76" as="geometry"/>
          </mxCell>
        </object>
        <object id="n:RLS" label="withWorkspace + RLS" mermaidId="RLS" mermaidShape="rectangle">
          <mxCell parent="1" vertex="1" style="fillColor=#ECECFF;fontColor=#333333;html=1;rounded=0;strokeColor=#9370DB;whiteSpace=wrap;">
            <mxGeometry x="178.25" y="1137.84375" width="221.5" height="52" as="geometry"/>
          </mxCell>
        </object>
        <object id="e:L_H_P_0" label="" mermaidId="L_H_P_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:H" target="n:P" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="289" y="60" as="sourcePoint"/>
              <mxPoint x="289" y="110" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="289" y="85"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_P_WK_0" label="eli_sk_" mermaidId="L_P_WK_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:P" target="n:WK" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="258.182964" y="175.026714" as="sourcePoint"/>
              <mxPoint x="136" y="519.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="242.84375"/>
                <mxPoint x="136" y="305.84375"/>
                <mxPoint x="136" y="368.84375"/>
                <mxPoint x="136" y="431.84375"/>
                <mxPoint x="136" y="482.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_P_UK_0" label="eli_uk_" mermaidId="L_P_UK_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:P" target="n:UK" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="319.817036" y="175.026714" as="sourcePoint"/>
              <mxPoint x="442" y="279.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="242.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_WK_WH_0" label="" mermaidId="L_WK_WH_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:WK" target="n:WH" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="136" y="571.84375" as="sourcePoint"/>
              <mxPoint x="136" y="645.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="608.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_WH_WS_0" label="" mermaidId="L_WH_WS_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:WH" target="n:WS" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="136" y="697.84375" as="sourcePoint"/>
              <mxPoint x="136" y="759.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="734.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_WS_WM_0" label="" mermaidId="L_WS_WM_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:WS" target="n:WM" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="136" y="835.84375" as="sourcePoint"/>
              <mxPoint x="136" y="885.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="860.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_WM_WG_0" label="" mermaidId="L_WM_WG_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:WM" target="n:WG" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="136" y="961.84375" as="sourcePoint"/>
              <mxPoint x="136" y="1023.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="986.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UK_UH_0" label="" mermaidId="L_UK_UH_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UK" target="n:UH" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="331.84375" as="sourcePoint"/>
              <mxPoint x="442" y="405.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="368.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UH_UM_0" label="" mermaidId="L_UH_UM_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UH" target="n:UM" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="457.84375" as="sourcePoint"/>
              <mxPoint x="442" y="507.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="482.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UM_UA_0" label="" mermaidId="L_UM_UA_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UM" target="n:UA" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="583.84375" as="sourcePoint"/>
              <mxPoint x="442" y="633.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="608.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UA_UC_0" label="" mermaidId="L_UA_UC_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UA" target="n:UC" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="709.84375" as="sourcePoint"/>
              <mxPoint x="442" y="759.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="734.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UC_UE_0" label="" mermaidId="L_UC_UE_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UC" target="n:UE" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="835.84375" as="sourcePoint"/>
              <mxPoint x="442" y="885.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="860.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UE_UG_0" label="" mermaidId="L_UE_UG_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UE" target="n:UG" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="961.84375" as="sourcePoint"/>
              <mxPoint x="442" y="1011.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="986.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_WG_RLS_0" label="" mermaidId="L_WG_RLS_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:WG" target="n:RLS" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="136" y="1075.84375" as="sourcePoint"/>
              <mxPoint x="211" y="1137.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="136" y="1112.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
        <object id="e:L_UG_RLS_0" label="" mermaidId="L_UG_RLS_0" mermaidKind="relationship">
          <mxCell parent="1" source="n:UG" target="n:RLS" edge="1" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;html=1;jettySize=auto;orthogonalLoop=1;rounded=0;strokeColor=#333333;">
            <mxGeometry relative="1" as="geometry">
              <mxPoint x="442" y="1087.84375" as="sourcePoint"/>
              <mxPoint x="367" y="1137.84375" as="targetPoint"/>
              <Array as="points">
                <mxPoint x="442" y="1112.84375"/>
              </Array>
            </mxGeometry>
          </mxCell>
        </object>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
