Security and retention

Troolio supplies contracts for actor messages and persistence, while the application host owns the security boundary. Authenticate requests before routing, authorize each command and target actor, and pass current principal evidence to selected routes. Correlation metadata is useful for tracing but is not an authorization token.

Data and credentials

Keep database, KurrentDB, broker, and external-provider credentials in a secret manager controlled by the host. Apply transport security and least privilege at every provider connection. Events may be retained for replay; design payloads so private data has an explicit minimization, encryption, retention, and erasure policy. Consider snapshots, projection copies, journals, and backups together when fulfilling deletion requirements.

Evidence lifetime

An operation receipt, route fence, effect intent, or broker journal may be required to recognize a retry. Retain that evidence for the maximum supported retry horizon, then expire it under a documented process. Erasure and deletion fences must be checked under the same authority as ordinary appends and selected commits. A retry cannot bypass a current deletion fence just because a matching historical receipt exists.

Review the third-party notices inside each NuGet package before redistribution. See route authority, external effects, and deployment checklist.

Example: Verify a trusted command identity

The server compares a claim to the current authenticated principal, actor path, command type, and canonical bytes. A mismatch fails before selected-route execution.

public static TrustedAtomicCommandIdentity VerifyIdentity(
    byte[] serverKey, TrustedAtomicCommandIdentityClaim claim,
    byte[] canonicalCommand) =>
    TrustedAtomicCommandIdentityAuthority.Verify(serverKey, claim,
        "user-42", "CounterActor/42", nameof(Increment), canonicalCommand);

Attribution and the current caller

Message metadata distinguishes acting users, owners, and recipients. Read-model design shows explicit access enforcement and filtered SQL reads. A correlation or user header is not proof of current permission.