Linea DocsTrust boundaries
Identity, credentials, and authority across the Operator and end-user planes.
Identity model
An Operator is the workspace customer that builds and operates workflows. An Application is the customer product that owns Workflow definitions. Each Application has fixed Development and Production Environments. Deployments, keys, identity trust, Connections, secrets, and runtime resources belong to an Environment.
An External Subject is Linea's canonical representation of an End User within a workspace and identity issuer. It is not a Linea account or workspace member.
Credential boundaries
| Credential | Can | Cannot |
|---|---|---|
| Member session | Perform actions allowed by the workspace role | Act as an external End User |
| Workspace Key | Use explicitly granted workspace operations | Substitute for an Environment Key or End-User Session |
| Environment Key | Access one Environment's server-side runtime resources | Cross Environments or change identity trust configuration |
| End-User Session | Act within its subject, Environment, audience, and scopes | Administer the workspace or act for another subject |
Data boundary
Repositories accept workspace identity as part of their query contract. Where a child identifier could be guessed or replayed, composite ownership constraints prevent it from escaping the parent workspace, Application, or Environment.
Never move secrets into the client
Environment Keys, Workspace Keys, provider credentials, and connector refresh tokens remain server-side. A browser receives only the narrow End-User Session capability intended for that boundary.