Security model
Built on the assumption that an agent will eventually try something it shouldn’t.
So the guard rails do not depend on the model behaving: allowlists, policy, approvals, scoping, scrubbing and audit sit between every agent and the world.
Controls
Layers, not promises.
Tool allowlist
Agents can only call tools named in their YAML and in policy.yaml’s global allowlist. There is no shell tool; ssh.safe_action accepts seven verbs.
Risk classification
Overrides → environment rules → tool defaults → default medium. Prod deploys, IAM reads, DDL in SQL and PRs to main are forced to high.
Approvals with RBAC
Only admin or the agent’s domain role may decide; requests expire after an hour; every decision is audited with actor and IP.
Injection guard + PII scrub
Every tool output is checked for prompt-injection patterns and scrubbed of PII before a model sees it.
AWS least privilege
Three role scopes, External ID encrypted at rest and never returned, per-tool scope requirements, read-only inventory calls.
Platform hardening
httpOnly SameSite cookies, TOTP MFA, login rate limit, CSRF header on writes, append-only audit, secrets by reference only.
Honesty
Limitations, stated plainly.
OIDC is not implemented (local auth + TOTP only). Single-node pilot without HA. LangGraph is not used — the orchestrator is our own typed state machine. Grafana / Prometheus dashboards are not bundled (metrics endpoint only). Scanners run only if their binaries are in the image. Real-mode integrations are not verified in CI.
Review it yourself
The policy file, the role templates and the audit trail are all in the repository and the portal.