AtlasCore

AtlasCore is a multi-tenant enterprise AI platform designed for secure knowledge access, controlled automation, organizational isolation, and auditable AI workflows. The current focus is foundational security and tenancy primitives rather than a finished end-to-end AI product surface.

Enterprise AI systems fail when tenant boundaries are soft, audit trails are incomplete, or agents can act without human-controlled authorization. AtlasCore starts from isolation, authentication, RBAC, and auditability so later intelligence features inherit a trustworthy control plane.

Phase 1 centers on application services, tenant isolation via PostgreSQL RLS, authentication hardening, and audit event pipelines. Later intelligence capabilities are intentionally deferred until this foundation is solid.

Tenancy is modeled around organisation and workspace isolation. Requests are scoped so data access and administrative actions cannot silently cross organisational boundaries.

PostgreSQL Row-Level Security, including FORCE RLS, is a core isolation mechanism. Database policy enforcement complements application-level checks rather than replacing careful query and authorization design.

Authentication design includes secure session handling with refresh-token families and replay detection. CSRF protection is part of the request security model for browser-facing flows.

Role-based access control governs what operators and services can do within an organisation or workspace. Privileges are intended to be explicit and auditable rather than ambient.

Audit events capture security-relevant actions so operational and administrative activity can be reviewed. This is foundational for enterprise trust and incident investigation.

Administrative identity work continues as part of active development. The portfolio presents this as a roadmap area rather than a completed Phase 2+ capability.

The security model emphasizes defence in depth: RLS and FORCE RLS, RBAC, refresh-token families, replay detection, CSRF protection, and audit logging. Human-controlled architecture remains a design constraint for automation that can affect organisational state.

PostgreSQL Row-Level Security · FORCE RLS · multi-tenancy · organisation/workspace isolation · RBAC · secure authentication · refresh-token families · replay detection · CSRF protection · audit events · human-controlled architecture

The following capabilities are planned after Phase 1 foundations. They are not claimed as finished functionality:

RAG · agent workflows · MCP · enterprise analytics

Status: In active development. Phase 1A and Phase 1B engineering cover tenancy and security foundations. Some Phase 1A runtime verification remains environment-dependent and is validated in the project's own development and CI contexts rather than claimed as a universal production deployment state.

Python · FastAPI · PostgreSQL · RLS · Redis · Docker