The threat model covers customer data, credentials, task state, execution capacity and financial records. Potential adversaries include malicious requesters, compromised executors, stolen service credentials and colluding operators. Admission does not make a workload or node permanently trustworthy.
Swipe or scroll to view all columns →
| Threat | Required control | Residual dependency |
|---|---|---|
| Cross-tenant access | Check ownership on every object operation; use scoped credentials | Negative authorization tests |
| Workload escape | Nonprivileged runtime, constrained mounts, quotas and restricted egress | Isolation testing for each runtime |
| Prompt-driven tool misuse | Policy enforcement outside the model; validate tool arguments | Application-specific action review |
| SSRF and arbitrary downloads | Controlled object references; validate destinations and redirects | DNS changes, metadata endpoints and egress enforcement |
| Forged or replayed receipts | Trusted key registry, complete binding and generation checks | Key custody and revocation policy |
| Duplicate charges | Stable usage and payment identifiers; reconciliation | External payment-channel behavior |
| Executor and checker collusion | Disclose control; retain evidence; use independent review where required | Actual organizational independence |
| Artifact compromise | Pinned artifacts, dependency inventory and vulnerability response | Build and distribution trust |
Data lifecycle#
DATA-01 Declare processing location, permitted providers and retention before accepting sensitive data. Keep raw inputs and outputs off public chains by default. Logs should contain identifiers, classifications and digests instead of customer content or credentials; even a digest may reveal low-entropy content through enumeration.
Secrets MUST NOT appear in task JSON, prompt text, browser source or routine logs. Issue short-lived, task-scoped access where possible. Define encryption in transit, storage encryption and key custody for the actual deployment; this specification does not certify a provider's controls.
Deletion policy must cover primary storage, caches, logs and backups with explicit time bounds. Record the difference between removing active access and expiring recoverable backups. No immediate-erasure or regulatory certification claim follows from this design.