Security architecture
CataZenta is designed for enterprise product data: strong identity, workspace isolation, encrypted secrets, and the same permission model across the UI, REST APIs, and MCP agents.
At a glance
| Area | Approach |
|---|---|
| Authentication | Industry-standard signed access tokens; asymmetric signing so only the identity service can issue credentials |
| Authorization | Role-based permissions on every API route — UI reflects the same rules |
| Isolation | Organization and workspace (tenant) scope on all catalog, DAM, syndication, and AI operations |
| Secrets | Marketplace and integration credentials encrypted; not exposed in routine API responses |
| AI | Tenant-scoped; permissions apply to Zen AI and MCP; human review before live publish |
| Transport | TLS for hosted APIs and applications |
Same model everywhere
Developers, merchandisers, and agents all hit the same authorization boundary — there is no “back door” API with full catalog access for integrations.
For security reviews
Full customer-facing detail — comparisons, AI governance, auditability, infrastructure trust, and evaluation checklist:
Technical authentication steps: API authentication · MCP authentication