Var's data-protection function: guarding personal data (PII), enforcing user-memory isolation, data classification and retention, and the privacy review gate.

Forseti's governance function: maintaining the security policy set, the risk register, periodic access recertification, and segregation-of-duties enforcement.

The IAM/PAM/JIT platform Heimdall runs directly: the registry RBAC schema (roles, permissions, grants), just-in-time expiring access, the credential vault and rotation, and the access-management surfaces. The structural foundation of who-may-do-what in Carolverse.

Vidar's product-security function: the build-time security review gate, secret and vulnerability scanning, and third-party / supply-chain security.

Tyr's security operations centre: brokering and expiring just-in-time access, continuous session and threat monitoring, incident response, and business-continuity / disaster-recovery resilience drills.

Provisions and governs per-agent OS identities so each agent can perform ONLY its own privileged work. Each agent owns a locked OS user that owns its privileged write surface; owner-daemons run as that user and serve a verified request queue any agent may append to. Radagast is backup admin (provision/de-provision, fallback operator). This is agent-identity management, distinct from the end-user (users table) record.

The core work of the security service.