Security methodology
This framework supplies methods for designing and reviewing untrusted-agent boundaries. Start with the adoption guide and fictional worked example; use this page as a supporting checklist, not a runtime validation report.
Guiding principles
- Agents as untrusted workloads - The agent process, dependencies, tool descriptions, retrieved content, and model output can be subverted.
- Default-deny posture - Network, filesystem, provider, capability, and tool policies start closed and require explicit allowance.
- Least-privilege runtime objective - Constrain runtime permissions and host access; do not infer a particular container engine from the generic reported hierarchy.
- Secrets by reference - Public examples use
secret://demo/...references or placeholders, never raw values. - Evidence over assertions - Claims require receipts, negative tests, digest/version identifiers, audit events, or configuration state.
- Review before mutation - Promotion and rollback are dry-run/review-first objectives; retired lab commands are not part of the public review workflow.
- Rollback as a first-class operation - Recovery evidence is part of the definition of done.
Example implementation and control objectives
| Layer | Role | Evidence limit |
|---|---|---|
| Generic host and operator-core VM | Operator-controlled substrate | No published outer containment test. |
| Logical realms | Workload grouping, called realms by the operator | Not a vendor object or an independently proved isolation boundary. |
| Individual sandboxes | Intended untrusted-agent execution boundary; OpenShell is one implementation choice | Historical receipt #1 covers one earlier inner sandbox only. |
| Runtime least privilege | Separate design objective | Historical rootless examples are not proof of current containment. |
| Managed provider path | Credential-mediation objective | Historical receipt #2 only observes placeholder configuration and one stopped misroute. |
| Ansible configuration as code | Repeatable provisioning, maintenance, and recovery workflows, as reported | No published successful recovery drill. |
Historical acceptance design
Retired platform/ fixtures preserve fictional VM/image/reconcile/microVM acceptance ideas. They are
not runnable here and their PASS examples are not measurements.
STRIDE mapping
| STRIDE | Mitigations in this architecture |
|---|---|
| Spoofing | explicit source/artifact identifiers; provider boundary; auth-deny evidence for production claims |
| Tampering | immutable revisions, digest-pinned examples, state re-derivation, receipt review |
| Repudiation | public receipts, audit-event expectations, rollback records |
| Information disclosure | default-deny egress, secrets by reference, no raw values in public artifacts |
| Denial of service | timeout/recovery expectations, canary/SLO requirements before production claims |
| Elevation of privilege | least-privilege runtime objective, capability review, bounded host access, sandbox boundary |
PASTA alignment
This methodology aligns with PASTA Stage 1 through Stage 7:
- Define objectives: governed sandboxing for untrusted agent workloads.
- Define technical scope: policy boundary, sandbox runtime, provider boundary, VM substrate, evidence.
- Decompose application: public input, policy gate, sandbox, provider path, receipts.
- Threat analysis: prompt injection, credential exposure, egress, lateral movement, runtime drift.
- Vulnerability analysis: hardening baseline, supply chain, provider routing, public/private boundary.
- Attack modeling: boundary negative tests and fail-closed provider behavior.
- Risk mitigation: controls, receipts, rollback drills, and manual declassification review.
Public review gates
Install docs dependencies in an isolated environment per the public reader quickstart, then run these checks before publishing:
make ci DOCS_PYTHON=.venv/bin/python
.venv/bin/python scripts/public-safety-scan
git diff --check
Then manually review for:
- real hostnames, IPs, VM names, service names, routes, ports, SSH aliases, and key names;
- NAS/mount paths, private repo paths, raw logs, transcripts, and incident details;
- token values, token ids, key material, provider credentials, and secret shapes;
- architecture drift that makes retired fixtures sound current or fictional PASS examples measured.
Scanner success is necessary but not sufficient.