Display and fleet security

Note

Planned architecture.

Key rules

• A Display UUID and GPS position are not credentials.

• Pairing tokens are short-lived, single-use and stored hashed.

• Display/media credentials rotate and can be revoked immediately.

• Generated View code runs in a sandbox with a restrictive CSP.

• Display writes require Assignment, Scope, Property and operation permission.

• GPS history and media access are scoped, retained and audited.

• Full frames/video never enter global WebSocket or telemetry channels.

• Mass campaigns support preview, impact count, approval and rollback.

• Signed media URLs have short TTL and audience/purpose constraints.

• Event IDs, revisions and idempotency keys protect against replay.

Tailscale provides a private transport between Agency, edge devices and local inference nodes. Its ACLs complement rather than replace Agency authentication, workspace authorization and application-level audit.

Generated content and AI observations remain untrusted input. Deterministic policy decides what can be published or acted on; Veronica’s probabilistic decision never bypasses those controls.