security:
  idp:
    issuer: https://idp.example.org/realms/ab
    mfa: { required: true, phish_resistant_only: true }
  vault:
    addr: https://vault.example.org
    namespace: alliance-boreale
    auth_method: oidc
    secret_refs: [ "vault://kv/example#dsn" ]
  pivot_c5:
    mtls: { required: true }
  logging:
    split_federated_tenant: true
    retention_days: 90
    time_source: { ntp_servers: [time.cloudflare.com] }
  backup:
    immutable_copy: true
    frequency: daily
    test_frequency: quarterly
    last_restore_test_at: null
  incident:
    sev_matrix_ref: repo://security/incidents/severity-matrix.md
    oncall_rotation_ref: repo://security/incidents/oncall.md
    status_page_url: https://status.example.org