ADR 0004: Restrict the Perflo credential bridge to non-production environments
This record defines the temporary bridge and its removal gate.Context
The current device refresh token grants more authority than the neobank needs. Encryption and route filtering reduce exposure but do not create upstream least privilege.Decision
Permit fake and broad device-link adapters only outside production. Encrypt pilot refresh tokens with Vault Transit, restrict upstream routes, serialize refresh, audit use, and erase credentials on disconnect. Production startup requires a partner adapter with audience-bound scopes and resource constraints. It refuses fake and pilot modes.Consequences
Developers can build against current contracts without representing the bridge as production-safe. Production remains blocked on PFR-001 through PFR-004 and PFR-007.Rejected alternatives
- Encrypted broad token in production: an authorized backend compromise could still exercise broad authority.
- Browser-held Perflo token: cross-site scripting would expose the upstream credential.