Scope

Cbox Operations persists and transitions operation records. It is deliberately not:

• An authorization boundary. It stores whatever kind, target_*, and tenant_id a caller supplies and does not decide who may start or read an operation. Enforce authorization in your application.
• A tenancy boundary. tenant_id is an optional column the package persists as-is; it applies no global scope. Bring your own scoping (e.g. a dedicated identity/tenancy package).

The OperationUpdated payload exposes the operation id, status, and step names only — never step inputs or secrets. Keep sensitive values out of kind, target_*, and step names.

Report vulnerabilities via GitHub Private Vulnerability Reporting (see SECURITY.md).