SECURITY DOCS
AgentPaaS threat model
This threat model maps each threat to its attack path, the control that contains it, the evidence behind that control, and what is not covered. Read how enforcement works and the known limitations.
STRIDE-condensed threat model
| Threat | Attack path | Control | Limitation / evidence |
|---|---|---|---|
| Malicious or buggy AI code exfiltrates secrets | Outbound HTTP, DNS, or raw socket | Brokered credentials, internal-only network, gateway-only egress, DNS stub, default deny, payload-hash audit | HTTP/HTTPS is checked at the gateway; raw non-HTTP traffic is blocked by isolation. |
| Secret theft from image or registry | Keys baked into layers | Keychain broker, gateway injection, pack-time scanner | Direct leases are explicit compatibility mode. |
| Prompt-injected unauthorized tool calls | MCP/tool call to non-approved server | MCP allow-list by server ID and per-tool policy | Per-tool argument constraints are later phase. |
| Container escape | Kernel/runtime exploit | Non-root, read-only rootfs, no shell, dropped capabilities, seccomp, no privileged mode, resource caps | Not a sandbox against kernel 0-days. |
| Supply chain, our dependencies | Compromised base image or dependency | Pinned digests, SBOM, go mod verify, dependency checks | Release controls do not remove upstream risk. |
| Supply chain, user dependencies | Typosquatted Python package | Locked installs, SBOM, advisory scan in pack output | A locked dependency can still be vulnerable. |
| Trigger API abuse | Replay or brute force | Idempotency keys, constant-time compare, rate limit, lockout, audit | Exposure requires API-key authentication. |
| Audit tampering | Attacker edits logs | Hash-chained JSONL, checkpoint signatures, signed export manifest, audit verify | Verification proves edits after the checkpoint. |
| Daemon compromise | Local privilege escalation | Daemon as user, socket 0600, no setuid, OS keychain APIs | Local mode trusts the developer machine. |
| Malicious webhook targets | Hook used as exfiltration channel | Hook destinations are policy-checked egress | Only declared destinations are reachable. |
| Dashboard exposure | Accidental 0.0.0.0 bind | Loopback default, --expose needs API key, CSRF tokens, strict CSP | Gateway-native ingress is deferred in P1. |
| Domain fronting | SNI does not match Host | Gateway cross-checks SNI, Host, DNS answer; mismatch denied and audited | Control covers the gateway path. |
ARCHITECTURE INVARIANT
One gateway per run
Every agent run receives its own dedicated gateway sidecar. A shared gateway across agents or runs is prohibited. Separate runs have no network path to each other, their gateways, or their brokered credentials. Cross-agent traffic uses workflow-scoped internal networks with per-binding capabilities.
WHAT WE DO NOT CLAIM
AgentPaaS is not a sandbox against kernel 0-days. Container hardening is not gVisor. Outbound DLP is fingerprint-based, not semantic. The P1 red-team suite is a fast smoke gate, not a full adversarial research corpus or pentest. Local mode trusts the developer's machine; we protect against the agent, not against the user.
SHARING THREATS
An impersonator is addressed by TOFU pinning and out-of-band fingerprint verification. A stolen publisher key is out of scope for v0.2.0, with no revocation until B26. Protect publisher keys as long-lived credentials.
What is agent security? · How enforcement works · GitHub docs
Last reviewed August 2026