Privacy boundary
Secrets, sessions, memories, media, caches, runtime databases, overlays, and raw logs stay local by default. OpenOrange works with redacted observations and references.
// prove.reviewed_workflow
Privacy and audit for AI operations
OpenOrange keeps AI operations reviewable with local secrets, redacted observations, request attribution, plan hashes, approvals, apply attempts, smoke checks, and rollback metadata.
OpenOrange treats privacy and audit as runtime operations, not paperwork. Sensitive values stay local or redacted, while plans, approvals, applies, smoke checks, request attribution, and rollback proof remain visible.
01
Secret values stay in local files or secret backends.
02
The control plane stores references and audit context, not copied token values.
03
Mutating work follows observe, validate, plan, approve, apply, smoke, audit.
04
Rollback metadata and smoke checks stay tied to the instance.
Reviewed workflows
Operator work should be reviewable before it becomes action. Plans carry approval shape, plan hash, apply intent, smoke checks, rollback metadata, and audit events.
Audit-ready runtime operations
The dashboard keeps the chain visible: who requested a change, what was planned, who approved it, what applied, what smoke checks ran, and how rollback would happen.
// questions
Does OpenOrange need secret values?
No. OpenOrange should store secret references and audit context while token values stay local or in the chosen secret backend.
Can production mutations be gated?
Yes. The operating model is plan-first and approval-gated, with smoke checks and rollback metadata tied to the instance.