Security Architecture & Trust Whitepaper

1. Cryptographic Cart Security (X-CSM-Cart-CSRF)

Every cart session is bound to a per-cart cryptographic CSRF token delivered through the strict X-CSM-Cart-CSRF header:

• Issued at cart creation and rotated on every mutation (add, update, remove).
• Enforced at strict level — requests without a valid token are rejected before touching inventory.
• Prevents CSRF request hijacking, cross-session cart injection, and session spoofing.

2. PCI-DSS Compliance Boundary

CSM Engine never stores raw credit card credentials in plain text — at rest or in transit through the MCP layer. Card data is tokenized client-side via Stripe Elements or the PayPal SDK before it reaches the engine. The compliance boundary is drawn at the gateway: CSM orchestrates payment intents and verifications without ever touching primary account numbers.

3. HMAC Webhook Signature Verification

Incoming payment webhooks are authenticated with dual-layer roundtrip signature checks (CSM_Stripe::check_webhook()). Every webhook's HMAC signature is validated against the gateway secret before processing, preventing replay attacks and spoofed payment confirmations. Events are idempotency-guarded so a replayed or duplicated webhook cannot double-apply an order state change.

4. Secret Masking & Dual-Credential Vault

API secrets (Stripe keys, PayPal credentials, webhook secrets) are encrypted at rest and masked in every tool response — agents and operators see fingerprints, never raw secrets. Live and sandbox credentials are stored symmetrically in a dual-credential vault, so switching environments for testing never requires destructive overwrites of production keys.

5. Granular Role-Based Access Control (RBAC)

Every MCP tool execution is capability-gated. Roles such as manage_csm_store, csm_manage_products, and csm_view_orders define exactly what each agent session may do:

• Read-only catalog managers can never mutate inventory or prices.
• Fulfillment bots can advance orders without access to payment credentials.
• Capability cloning lets merchants mint least-privilege roles per agent in seconds.

6. Immutable Audit Logging

Every AI agent tool call, API token use, and admin modification is recorded in an append-only audit trail (audit_log_list) with timestamp, actor identity, affected entities, and full argument fingerprints. Logs are immutable — they cannot be edited or silently deleted — giving merchants and investors a complete forensic record of every autonomous action.