> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.useharmonia.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and identity platform

> Operator identity, workload identity, and secret boundaries in Harmonia.

## How Harmonia uses it

Amazon Cognito establishes operator identity and workspace membership. Separate IAM roles identify ECS Fargate, AgentCore, and automation workloads. AWS Secrets Manager keeps provider credentials server-side; browsers receive neither integration secrets nor machine credentials.

<CardGroup cols={2}>
  <Card title="Cognito Authentication" href="/platform/security/cognito">Operator authentication and tenant scope.</Card>
  <Card title="IAM roles" href="/platform/security/iam-service-accounts">Machine identity and least privilege.</Card>
  <Card title="AWS Secrets Manager" href="/platform/security/secret-manager">Credential storage and delivery.</Card>
</CardGroup>

## Evidence status

Repository policy and tests verify access checks locally. Production IAM grants, secret versions, and authenticated access must be verified in the target project without exposing secret values.