GEL — Security Model
Security posture, gating, and exception handling for GEL. Integrations detail → GEL - Integrations.
Information is classified by certainty — do not treat planned capabilities as currently implemented.
Current / Confirmed
Confirmed
- GEL is an internal developer / application governance platform.
- GEL tracks applications, components, ownership, and environment representation.
- GEL is intended to consume security and governance signals (Snyk, pentest, ARB).
- Vault is a specific service; GEL is the broader governance layer.
Note
Specific current GEL security features (live gate enforcement, scorecard fields, etc.) have not been confirmed in available documentation. Treat operational details as To Confirm until validated.
Planned / Discussed
Planned / Discussed
The following reflects discussed / anticipated GEL security workflow. Not confirmed as implemented.
Security Gates
GEL is intended to become a deployment / security decision point, combining inputs from Snyk, pentest status, and ARB review.
flowchart TD A[Application] --> B[GEL] B --> C[Snyk] B --> D[Pentest] B --> E[ARB] C --> F[Security Decision] D --> F E --> F F --> G{Allow / Block Deployment}
Application Security States
| State | Meaning |
|---|---|
| Not Assessed | No security evaluation recorded |
| Testing | Assessment in progress |
| Pass | All required checks satisfied |
| Pass with Exception | Approved deviation with documented justification |
| Fail | Critical or unresolved findings |
| Retest Required | Remediation submitted; verification pending |
Gate Logic (Anticipated)
| Condition | Likely Outcome |
|---|---|
| Critical unresolved finding | Block |
| Required pentest incomplete | Block / Restrict |
| ARB review missing | Block |
| Approved exception on file | Allow according to policy |
Exception Workflow (Anticipated)
Exception metadata should include:
- Approver
- Business justification
- Remediation / expiration date
- Re-evaluation trigger
Security Posture Areas (Anticipated)
- Application ownership and component permissions
- Environment boundaries (Dev / Test / Prod)
- Internet-facing application controls
- Security scorecards
- Deployment governance
To Confirm
To Confirm
- Which security gate features are currently live vs roadmap?
- What triggers a deployment block today?
- How are exceptions recorded and approved?
- What security posture fields exist on applications/components?
- How is internet-facing status tracked and enforced?
- How does pentest status get recorded in GEL?
- Is Red Team AI Workspace integration planned or active?
- Is ServiceNow integration in scope?
Impact on Vault Pentest
When documenting Vault findings, note potential GEL gate signal:
→ Vault API - Findings > Finding Template — GEL Gate Candidate field
| Finding Severity | Potential Gate Signal |
|---|---|
| Critical unresolved | Block |
| Required pentest incomplete | Block / Restrict |
| Approved exception | Allow per policy |