Compatibility: Pactmark 0.1.x.

​
The core rule

The model is never authority.
Figure 1. Authentication, tenant binding, policy, grants, approvals, budgets, schema validation, credentials, egress, verification and effect execution all stay in host-controlled ports. Everything else on this page is an expression of that rule.

​
The control set

Policy default is the literal "deny". A risk class with no rule is denied. Unknown metadata or an unsupported capability fails closed rather than degrading.
Every store method and every command takes tenant identity and authority explicitly. There is no global “current user”.
Resolved model and tool credentials never appear in model context, events, artifacts, evidence, telemetry or ordinary diagnostics. Redaction canaries assert this across every surface.
Projections are disposable caches. An attacker who can rewrite your projection has not rewritten what happened.
An uncertain outcome is not retried without proof. That prevents an attacker — or a network blip — from turning one authorised action into several.
Registration digests make same-version drift observable and reject unsafe resume.

​
What happens on a tool call

Figure 2. Six gates, per effect, each with a stable failure code. A cached admission is not authority — a running agent re-checks revocation before its next high-risk action.

​
Fail-closed, and non-disclosing

Two properties that matter together:

Fail closed

Unknown risk metadata, an unresolvable grant, an unsupported capability, a drifted registration — all refuse. There is no permissive fallback path.

Fail without disclosing

A refusal deliberately avoids revealing whether another tenant’s resource, secret, tool or run exists. Logs and HTTP responses use different disclosure levels.
That second property is why KAF_STORAGE_NOT_FOUND is the honest answer to both “it does not exist” and “it exists but is not yours”. Denial messages must not become an enumeration oracle.

​
Prompt injection, direct and indirect

Direct injection (TM-01) and indirect injection through files, web content, MCP results or tool output (TM-02) are both rated critical. The controls are structural:
1

The model has no authority

It can request; it cannot permit.
2

Exact AgentDefinition and WorkOrder binding

Purpose, data class and egress profile come from the accepted work order, not from content.
3

Default-deny policy with a per-effect recheck

Persuading the model does not persuade the policy.
4

Bounded context admission

Returned content is data. It is admitted under byte bounds and carries no capability.
Residual risk, stated plainly: semantic manipulation inside admitted data remains a model risk, and an allowed action can still be undesirable inside an over-broad host grant. Pactmark bounds the blast radius. It does not make a model immune to persuasion.

​
Redaction is enforced before export

Prompts, completions, workspace bodies, tool arguments and results, credentials, challenge proofs, protected context and hidden reasoning do not enter telemetry or evidence. This is enforced at the export boundary, not configured downstream, and secret canaries run across events, telemetry, evidence, artifacts, HTTP responses and error surfaces in CI.

​
What this does not establish

This design reduces specific risks with specific controls. It does not establish complete security, production isolation, compliance or certification. The reference sandbox is explicitly unsafe for production arbitrary-code isolation, and every green test applies only to its exact fixture and environment.

Threat model

Eighteen high and critical rows with controls, evidence, owners and residual risk.

Sandbox boundary

Why the reference container is a fixture, not isolation.

Supply chain

Deterministic candidates, byte-identical tarballs and guarded publication.

​
Reporting a vulnerability

Do not disclose an unpatched vulnerability in a public issue. Follow SECURITY.md and the private reporting channel. Maintainers triage scope and supported versions, preserve evidence, revoke exposed authority, add a failing regression test, prepare a coordinated fix, refresh advisories and SBOM, and re-run the complete candidate gates. Externally exposed failed version bytes are never reused. Publication happens only through the separately authorised release workflow.