[MINOR] Clarify security boundaries and notebook permissions

[jongyoul]

Summary

• Link the operator-facing security page to the canonical threat model.
• Clarify that UI, REST, and WebSocket note operations must enforce notebook permissions.
• Distinguish application-level notebook ACLs from interpreter and OS-level isolation.
• Describe the default interpreter OS identity and point operators to user impersonation.

This resolves an ambiguity where the previous wording could be read as disclaiming notebook authorization for authenticated users.

Verification

• git diff --check
• Threat model and user impersonation links returned HTTP 200
• Jekyll build was not run locally because Docker is unavailable

This is a documentation-only change.

[Copilot]

🟢 Approval recommended

The change is documentation-only and aligns with the stated goal, with remaining feedback limited to minor clarity/navigation improvements.

Pull request overview

Documentation-only update to the operator-facing security guidance for Apache Zeppelin, clarifying the project’s security boundaries, how notebook/note permissions apply across interfaces, and how interpreter OS identity relates to isolation.

Changes:

• Link security.md to the canonical Zeppelin threat model.
• Clarify that note operations via UI/REST/WebSocket are subject to note permission settings, and distinguish these ACLs from OS/interpreter isolation.
• Describe default interpreter OS identity behavior and point operators to interpreter user impersonation.

File summaries

File	Description
security.md	Adds threat model link and clarifies notebook permission vs OS-level isolation and interpreter identity expectations.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.