Security
Zero Trust posture, the threat model this design defends against, and the fail-safe rule that governs every unverifiable request.
Zero Trust for agent identity and execution.
Verify explicitly, apply least privilege and assume breach across identity, model, tool, workload and evidence boundaries. Signature, issuer, status, policy, workload and destination are all checked before a protected action — every time, not at commissioning.
When identity, signature, status, policy, evidence source, workload context or safe operating conditions cannot be verified: restrict, defer, isolate or escalate. Never continue autonomously.
Prevent
Strong issuance, least privilege, model and workload allowlists, protected keys and secure deployment boundaries.
Detect
Continuous status, gateway telemetry, attestation, anomaly signals, signed events and missing-evidence detection.
Respond
Suspend passports, revoke credentials, isolate workloads, preserve evidence, notify owners and require re-authorization.
Design against identity, delegation, runtime and evidence attacks.
| Threat | Example | Primary controls | In this build |
|---|---|---|---|
| Agent impersonation | A copied agent ID, service principal or token is presented by something else. | CPID verification; proof of possession; short-lived credentials; issuer and status check. | Implemented |
| Token replay | A credential is reused outside its time, audience or workload. | Nonce and audience binding; expiry; replay cache; workload binding; mTLS. | Implemented |
| Delegation laundering | Authority is passed through agents until the source is obscured. | Visible delegation graph; authority ceiling; named sponsor; no self-escalation. | Implemented |
| Model substitution | An approved agent invokes an unapproved model or endpoint. | Model passport; gateway allowlist; artifact and version check; approval gate. | Implemented |
| Workload drift | Image, region, network or configuration changes after approval. | Image digest; admission control; attestation; material-change trigger. | Designed |
| Tool abuse | An authorized connector is used for unauthorized data or state change. | Tool interceptor; transaction limits; destination allowlist; dual approval. | Implemented |
| Evidence tampering | Logs, approvals or provenance are selectively changed after the fact. | Signed events; append-only storage; hash chains; immutable audit; retention. | Implemented |
| Issuer compromise | A signing key or an administrator is abused. | HSM; quorum; per-tenant keys; key attestation; rotation; emergency trust revocation. | Designed |
Implemented means the control is exercised by this MVP. Designed means the control is specified but not yet built — usually because it needs an enforcement point or hardware custody this build does not have.
Every material action becomes a reproducible decision record.
Records carry a canonical event id, a trusted time source, a detached signature, a content hash and an immutable logical sequence. Each one commits to the digest of the record before it, so a silent edit anywhere breaks verification from that point forward.
The portal exposes this directly: recompute the chain, and see which record failed and why.
Evidence records are hash-chained and signed within this instance. Tamper-evidence here is local: production deployments write to append-only storage outside the application boundary with an independent trusted time source.