# CI/CD: every stage carries a trust boundary

https://thiago.limaesilvatecnologia.com.br/en/artigos/pipeline-trust/

Published: 2026-09-12

Building code and authorizing production are different decisions.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: January 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

A pipeline connects code, tools and credentials. Treating it as one trusted process makes the impact of a seemingly auxiliary change difficult to explain.

## Practical application

Editorial proposal: map who supplies inputs to build, testing and release. In a hypothetical workflow, an external contribution can run tests without receiving the production identity. Separation must exist during execution, not just in a diagram.

## How to verify

Review one small pipeline change: which permissions can it reach? Record shared-template owners and exceptions. Useful evidence demonstrates that a lower-trust stage cannot promote its own output without the intended control.

## Sources

- [OWASP — CI CD Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)