Threat model

This framework treats AI agents as untrusted, tool-wielding workloads. Assume an agent can be misdirected by untrusted input or compromised through tools, dependencies, runtime, or operator workflow. Adapt these assets and controls using the adoption guide.

Assets

Asset	Why it matters
Operator intent and policy	The system must distinguish approved authority from prompt-driven behavior.
Sandbox state	Files, sessions, task state, and local caches may contain sensitive or integrity-critical data.
Provider credentials	Model/tool-provider credentials must remain outside agent-readable material and public receipts; a protected mediator may resolve them for an approved operation.
Runtime boundary	A compromised agent should not become a compromised host or sibling workload.
Tool surface	Shell, file, browser, network, messaging, and orchestration tools can create real-world effects.
Evidence receipts	Operators need reliable proof for denied crossings, provider routing, rollback, and non-claims.

Actors

Actor	Capability
Prompt-injection attacker	Supplies content that tries to steer the agent into unsafe tool use or data exfiltration.
Compromised agent workload	Executes unexpected tool calls or attempts lateral movement.
Malicious dependency or artifact	Enters through package install, image build, or copied runtime assets.
Mistaken operator	Runs the wrong command, deploys the wrong revision, or skips rollback proof.
Network attacker	Attempts unauthorized access to exposed endpoints or relies on unexpected outbound reachability.
Repository attacker	Attempts to alter workflows, scripts, manifests, or docs to weaken validation.

Trust boundaries

generic host
  -> operator-core VM (operator governance)
      -> logical realms (workload grouping, not a security guarantee)
          -> individual agent sandboxes (intended execution boundary)
              -> separate policy/provider/runtime controls

This is one deployment shape, not a required stack. OpenShell is the operator-reported sandbox choice.

Boundary rules:

The repository contains illustrative docs/examples and static checks, not live secrets or runnable deployment and lab fixtures.
Public diagrams are abstractions, not deployment maps.
The sandbox is treated as a lower-trust execution boundary.
Provider credentials are represented by references or placeholders in public examples.
Least-privilege runtime design does not establish a particular current container engine.
Tool allowlists fail closed; denied or unknown tools should not silently become available.
Public receipts state what was measured and what remains pending.

Primary threats and controls

Threat	Control
Prompt injection triggers unsafe tools	Explicit tool/data gates, risk tiers, human approval for sensitive writes, audit events.
Agent exfiltrates data over the network	Default-deny egress, SSRF/lateral/DNS negative tests, managed provider path.
Agent reads a provider credential	Separate mediator identity, secret-service authorization, and non-disclosure checks are required; placeholder configuration does not prove successful credential custody.
Agent escapes into host or sibling workload	Individual sandboxes and operator-core VM are intended layers; realm grouping does not prove isolation.
Runtime drift or stale claims	Re-derive actual state, identify revisions, and require scoped receipts before stronger claims.
Secret exposure in git/logs/images	`.gitignore`, public-safety scan, manual declassification review, no raw values in receipts.
Broken rollback	Rollback target and recovery evidence required before production-ready language.

Current limitations

Historical receipt #1 reports inner sandbox probes; receipt #2 reports placeholder configuration and one stopped misroute. Neither retests the current operator-reported architecture.
Logical realms group workloads, but no inter-group or outer containment proof is published.
Ansible is the reported configuration-as-code choice; other systems can satisfy the framework. No successful recovery drill is established by this public narrative.
Retired platform/ fixtures and fictional PASS examples are design history, not measured results.
This repository includes no real secret manager, audit backend, customer deployment, or external monitoring stack.

Security invariants

These requirements should not be waived for production use:

missing or invalid auth is denied;
denied tools are absent or fail closed;
unknown tools fail closed;
raw secrets never appear in git, logs, manifests, images, or receipts;
egress is denied by default and has a negative test;
provider credentials remain inaccessible to the untrusted agent, including through environment, files, logs, and mediator APIs;
rollback is tested and timed;
runtime identity is proven before smoke-test claims;
production promotion is based on evidence, not on unit creation alone.