{
  "schemaVersion": 1,
  "documentType": "Tarly Cowork Secure Configuration Guide",
  "fedRampPackageId": "FR2628650874",
  "version": "1.2",
  "updatedAt": "2026-08-17",
  "releaseHistoryUrl": "https://gov.tarly.co/trust/secure-configuration-guide.html#revision-history",
  "releaseHistory": [
    {
      "version": "1.2",
      "releasedAt": "2026-08-17",
      "recommendedSecureDefaultChanges": "No recommended secure default value was relaxed. Added the complete settings comparison and the all-security-settings export as authenticated capabilities, and pointed the platform-administrator, administrator-MFA, and public-sharing settings at the new observable sources that replaced their manual review paths."
    },
    {
      "version": "1.1",
      "releasedAt": "2026-08-14",
      "recommendedSecureDefaultChanges": "No recommended secure default value was relaxed. Added stable setting IDs, comparison operators, current-value sources, provisioning defaults, machine-readable access, and a desensitized secure-default gap status."
    },
    {
      "version": "1.0",
      "releasedAt": "2026-07-17",
      "recommendedSecureDefaultChanges": "Initial baseline for named platform administrators, least-privilege procurement-file roles, administrator provisioning and removal, public-sharing defaults, operating review, and decommissioning."
    }
  ],
  "service": "Tarly Cowork production",
  "humanReadableGuide": "https://gov.tarly.co/trust/secure-configuration-guide.html",
  "comparisonSemantics": {
    "resultValues": [
      "matches",
      "stricter",
      "deviates",
      "not-observable",
      "not-applicable"
    ],
    "instruction": "Compare each current value obtained from currentValueSource to recommendedValue using comparison.operator. A setting that cannot be observed must return not-observable; it must not be assumed compliant.",
    "completeComparisonCapabilityAvailable": true,
    "completeSecuritySettingsExportAvailable": true
  },
  "capabilities": {
    "securitySettingsApi": {
      "status": "available",
      "available": [
        "Authenticated procurement-file managers can list, add, change, and remove file membership through /api/contract-files/{id}/members.",
        "Authenticated users can list, enroll, and remove their own passkey credentials through /api/auth/mfa endpoints.",
        "Any authenticated caller can read all effective security settings in their scope through /api/security-settings/export.",
        "Any authenticated caller can compare those settings to these recommended defaults through /api/security-settings/comparison."
      ],
      "scope": "Every security setting that belongs to a customer's scope is both readable and adjustable through the API. The platform-administrator allowlist and the global MFA and session policy are deliberately outside it: they are platform-wide policy rather than one customer's setting, and a customer API able to change them would let one tenant weaken the posture every tenant relies on. Those changes are made by the provider on request to security@tarly.co, under the approval and audit controls described in this guide."
    },
    "comparison": {
      "status": "available",
      "endpoint": "/api/security-settings/comparison",
      "access": "Authenticated. Returns every setting in this guide compared to its observed current value, using the operator published with that setting. Scope follows the caller: a platform administrator sees the administrator settings, and any caller sees the procurement files they manage. A setting that cannot be observed returns not-observable and clears summary.complete; it is never assumed to match."
    },
    "export": {
      "status": "available",
      "endpoint": "/api/security-settings/export",
      "access": "Authenticated. Returns all effective security settings in this caller's scope as JSON, including effective platform policy, the platform-administrator roster with passkey enrollment, privileged procurement-file membership, and public conversation sharing. Add ?download=1 for a file attachment."
    }
  },
  "recommendedSettings": [
    {
      "id": "platform-admin-named-approved-only",
      "scope": "top-level-platform-administrator",
      "title": "Named, approved platform administrators only",
      "recommendedValue": "Every entry is an individually assigned account with documented business need, approval, and bounded duration; no shared, seeded, or default credential is privileged.",
      "comparison": {
        "operator": "manual-all-records-satisfy"
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/security-settings/comparison",
        "jsonPointer": "/settings/*/observedValue",
        "note": "Platform administrator scope; returns each allowlist entry with whether it is an individually assigned, existing, active account."
      },
      "customerAdjustable": false,
      "provisioningDefault": "Provider approval required before allowlist entry"
    },
    {
      "id": "platform-admin-mfa-required",
      "scope": "top-level-platform-administrator",
      "title": "Phishing-resistant MFA required",
      "recommendedValue": true,
      "comparison": {
        "operator": "equals"
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/security-settings/comparison",
        "jsonPointer": "/settings/*/observedValue",
        "note": "Platform administrator scope; returns enrolled passkey count for every administrator, not only the calling user."
      },
      "customerAdjustable": true,
      "provisioningDefault": "MFA enrollment required before a new Cowork user receives a production session"
    },
    {
      "id": "procurement-file-initial-manager",
      "scope": "procurement-file-privileged-account",
      "title": "Initial file manager is the accountable creator",
      "recommendedValue": "co",
      "comparison": {
        "operator": "equals",
        "condition": "Creator is the accountable contracting officer and needs members:manage."
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/contract-files/{id}/members",
        "jsonPointer": "/items/*/role"
      },
      "customerAdjustable": true,
      "provisioningDefault": "The procurement-file creator is assigned CO; reassignment requires an existing manager and is audit logged."
    },
    {
      "id": "procurement-file-added-member-explicit-role",
      "scope": "procurement-file-privileged-account",
      "title": "No implicit privileged role for added members",
      "recommendedValue": "least privileged role that satisfies documented duties; Admin or CO only for membership/content administration",
      "comparison": {
        "operator": "manual-role-to-business-need"
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/contract-files/{id}/members",
        "jsonPointer": "/items/*/role"
      },
      "customerAdjustable": true,
      "provisioningDefault": "The caller must submit an explicit validated role; the service does not default a newly added member to Admin or CO."
    },
    {
      "id": "procurement-file-manager-continuity",
      "scope": "procurement-file-privileged-account",
      "title": "At least one accountable file manager remains",
      "recommendedValue": "At least one Admin or CO",
      "comparison": {
        "operator": "count-at-least",
        "value": 1
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/contract-files/{id}/members",
        "jsonPointer": "/items/*/role"
      },
      "customerAdjustable": true,
      "provisioningDefault": "The service rejects removing or demoting the last Admin or CO."
    },
    {
      "id": "public-conversation-sharing",
      "scope": "procurement-file-security-operation",
      "title": "Public conversation sharing disabled until explicit action",
      "recommendedValue": false,
      "comparison": {
        "operator": "equals"
      },
      "currentValueSource": {
        "type": "authenticated-api",
        "endpoint": "/api/security-settings/export",
        "jsonPointer": "/conversationSharing/*/publiclySharedConversations"
      },
      "customerAdjustable": true,
      "provisioningDefault": "No public share token exists until an authorized user explicitly creates one."
    }
  ],
  "knownSecureDefaultGap": {
    "id": "SCG-SDF-GAP-001",
    "status": "open",
    "description": "An open provider-controlled platform-administrator provisioning gap remains under remediation. Specific account identities, credential details, live status, and closure evidence are retained in controlled security records and are not published.",
    "owner": "Tarly Security Engineering",
    "requiredClosureEvidence": "Approved disposition, authentication-control evidence, corrected future provisioning, verified deployed configuration, and a passing read-after-deploy review retained in controlled security records."
  }
}