Security model: what a model can reach, and what it cannot

Security model: what a model can reach, and what it cannot An architecture diagram generated by Archify. Trusted config ref · never the change under review · Architecture component Trusted config ref never the change under review Chat-ops gate · authorizes the asker · Architecture component Chat-ops gate authorizes the asker OIDC / key · short-lived, scoped · Architecture component OIDC / key short-lived, scoped Auth resolver · resolved at the edge · Architecture component Auth resolver resolved at the edge Ticket / diff / logs · attacker-influenceable · Architecture component Ticket / diff / logs attacker-influenceable Context package · provenance-tagged · Model job: provider credential, read-only Context package provenance-tagged Injection scan · findings travel with the run · Model job: provider credential, read-only Injection scan findings travel with the run Composed prompt · guardrails first · Model job: provider credential, read-only Composed prompt guardrails first AiInvoker · holds the credential · Model job: provider credential, read-only AiInvoker holds the credential EgressPolicy · probe-verified, fail closed · Model job: provider credential, read-only EgressPolicy probe-verified, fail closed ToolSet · deny by default · Model job: provider credential, read-only ToolSet deny by default Sandbox · no network, no credentials · Model job: provider credential, read-only Sandbox no network, no credentials ChangeGuard · tiers; tests never silenced · Model job: provider credential, read-only ChangeGuard tiers; tests never silenced Redact + sink · every write masked · Architecture component Redact + sink every write masked Staged ChangeSet · an untrusted artifact · Architecture component Staged ChangeSet an untrusted artifact Propose job · write token, no provider · Write job Propose job write token, no provider Pull request · run-scoped branch, a person reads · Write job Pull request run-scoped branch, a person reads loaded first UNTRUSTED scanned delimited mint credential check before call run_script write_file staged guard again open_change records delegate: child loop, one spend, one tape Model job: provider credential, read-only Write job Legend Backend Database Cloud Security External

A successful injection has nothing to take

  • • Keys resolve at the edge and never enter the context package
  • • The job that writes cannot reach a model; the job with the model cannot write

Text selects nothing

  • • The comment picks a command; the gate authorizes the person
  • • The ticket body is delimited, scanned, and never a control surface