Platform
Security model
What we assume an attacker can do, what we do about it, and where the honest answer is that a mitigation reduces risk rather than removing it.
Assumptions
- · Any content the system retrieves may contain instructions intended to subvert it.
- · Any capability an agent can reach may be attempted on an attacker’s behalf.
- · Users are authenticated but not uniformly entitled, and entitlements change faster than indexes refresh.
- · The audit trail is itself sensitive and is subject to the same controls as the data it describes.
- · Defences degrade silently unless they are tested by something that can fail the build.
Threats and mitigations
| Threat | If it succeeds | What we do |
|---|---|---|
| Prompt injection via retrieved content | Agent follows instructions embedded in a document | Retrieved content treated as untrusted input throughout; tool scopes bound to the task, not the system; irreversible actions behind human gates; injection cases in the regression suite. |
| Tool abuse / confused deputy | Agent uses a legitimate capability on the attacker’s behalf | Per-agent scoped credentials rather than a service account with standing access; typed tool contracts that fail rather than improvise; the calling principal recorded on every invocation. |
| Entitlement bypass through retrieval | User receives content, or an answer derived from content, they may not read | Entitlement predicate pushed into the query; cache keys include the principal; citation lists filtered so refusals do not disclose document existence. |
| Model or artefact tampering | A modified model or dependency runs in production | Signed manifests verified before admission to the internal registry, fail closed; digests carried into deployment records; SBOM for everything that crosses a boundary. |
| Data exfiltration through tool egress | Sensitive content leaves via a tool with outbound access | Default-deny egress at the network layer; tools that require outbound access enumerated and justified individually; egress attempts logged and alerted. |
| Trace and log disclosure | The audit trail becomes the leak | Payloads stored by hash where the content is regulated; retention and access controls on the trace store equal to the source data; derived summaries classified with the source. |
| Runaway cost or loop | An agent consumes budget or capacity without producing value | Hard token and turn budgets per node; declared stopping conditions; escalation rather than continuation when a budget is exceeded. |
Supply chain
Images built outside the boundary and transferred as built artefacts, never resolved from a partial mirror inside. Dependencies pinned by digest. SBOM generated at build and retained with the artefact. Signatures verified before admission, failing closed. In air-gapped environments this is a documented procedure reviewed once by the security team, platform team and change board together, rather than an exception raised per crossing.
Logging and retention
Append-only, framework-independent, and classified at the level of the data it describes. Payloads may be stored by hash where content cannot be retained, so a trace survives even when its subject matter does not. Access to the trace store is itself audited, because in most of our engagements it is the most sensitive store in the system.
Send us your threat model.
If you have one, we would rather start there than from ours. If you do not, building one is a reasonable first two weeks.