---
title: Plugin Security Advanced
description: Plugin Security Advanced protocol schemas
---

{/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs go in content/docs/guides/. */}

# Plugin Security and Sandboxing Protocol

Defines comprehensive security mechanisms for plugin isolation, permission

management, and threat protection in the ObjectStack ecosystem.

Features:

- Fine-grained permission system

- Resource access control

- Sandboxing and isolation

- Security scanning and verification

- Runtime security monitoring

<Callout type="info">
**Source:** `packages/spec/src/kernel/plugin-security-advanced.zod.ts`
</Callout>

## TypeScript Usage

```typescript
import { KernelSecurityPolicy, KernelSecurityScanResult, KernelSecurityVulnerability, PermissionAction, PermissionScope, PluginTrustLevel, ResourceType, RuntimeConfig, SandboxConfig } from '@objectstack/spec/kernel';
import type { KernelSecurityPolicy, KernelSecurityScanResult, KernelSecurityVulnerability, PermissionAction, PermissionScope, PluginTrustLevel, ResourceType, RuntimeConfig, SandboxConfig } from '@objectstack/spec/kernel';

// Validate data
const result = KernelSecurityPolicy.parse(data);
```

---

## KernelSecurityPolicy

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **csp** | `Object` | optional |  |
| **cors** | `Object` | optional |  |
| **rateLimit** | `Object` | optional |  |
| **authentication** | `Object` | optional |  |
| **encryption** | `Object` | optional |  |
| **auditLog** | `Object` | optional |  |


---

## KernelSecurityScanResult

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **timestamp** | `string` | ✅ |  |
| **scanner** | `Object` | ✅ |  |
| **status** | `Enum<'passed' \| 'failed' \| 'warning'>` | ✅ |  |
| **vulnerabilities** | `Object[]` | optional |  |
| **codeIssues** | `Object[]` | optional |  |
| **dependencyVulnerabilities** | `Object[]` | optional |  |
| **licenseCompliance** | `Object` | optional |  |
| **summary** | `Object` | ✅ |  |


---

## KernelSecurityVulnerability

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **cve** | `string` | optional |  |
| **id** | `string` | ✅ |  |
| **severity** | `Enum<'critical' \| 'high' \| 'medium' \| 'low' \| 'info'>` | ✅ |  |
| **category** | `string` | optional |  |
| **title** | `string` | ✅ |  |
| **location** | `string` | optional |  |
| **remediation** | `string` | optional |  |
| **description** | `string` | ✅ |  |
| **affectedVersions** | `string[]` | ✅ |  |
| **fixedIn** | `string[]` | optional |  |
| **cvssScore** | `number` | optional |  |
| **exploitAvailable** | `boolean` | ✅ |  |
| **patchAvailable** | `boolean` | ✅ |  |
| **workaround** | `string` | optional |  |
| **references** | `string[]` | optional |  |
| **discoveredDate** | `string` | optional |  |
| **publishedDate** | `string` | optional |  |


---

## PermissionAction

Type of action being permitted

### Allowed Values

* `create`
* `read`
* `update`
* `delete`
* `execute`
* `manage`
* `configure`
* `share`
* `export`
* `import`
* `admin`


---

## PermissionScope

Scope of permission application

### Allowed Values

* `global`
* `tenant`
* `user`
* `resource`
* `plugin`


---

## PluginTrustLevel

Trust level of the plugin

### Allowed Values

* `verified`
* `trusted`
* `community`
* `untrusted`
* `blocked`


---

## ResourceType

Type of resource being accessed

### Allowed Values

* `data.object`
* `data.record`
* `data.field`
* `ui.view`
* `ui.dashboard`
* `ui.report`
* `system.config`
* `system.plugin`
* `system.api`
* `system.service`
* `storage.file`
* `storage.database`
* `network.http`
* `network.websocket`
* `process.spawn`
* `process.env`


---

## RuntimeConfig

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **engine** | `Enum<'v8-isolate' \| 'wasm' \| 'container' \| 'process'>` | ✅ | Execution environment engine |
| **engineConfig** | `Object` | optional |  |
| **resourceLimits** | `Object` | optional |  |


---

## SandboxConfig

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **enabled** | `boolean` | ✅ |  |
| **level** | `Enum<'none' \| 'minimal' \| 'standard' \| 'strict' \| 'paranoid'>` | ✅ |  |
| **runtime** | `Object` | optional | Execution environment and isolation settings |
| **filesystem** | `Object` | optional |  |
| **network** | `Object` | optional |  |
| **process** | `Object` | optional |  |
| **memory** | `Object` | optional |  |
| **cpu** | `Object` | optional |  |
| **environment** | `Object` | optional |  |


---

