# Security boundaries

> A map of the trust boundaries that matter when running autonomous agents with tentaflake.

Canonical page: https://docs.tentaflake.dev/concepts/security-boundaries/

tentaflake separates configuration, credentials, network access, tool execution, and persistent state into explicit boundaries. The controls are composable, but no single control makes an untrusted agent safe.

## Boundary map

| Boundary | Mechanism | Review next |
| --- | --- | --- |
| Agent process → host | Hardened container and systemd policy | [Threat model](https://docs.tentaflake.dev/security/threat-model/) |
| Agent → model provider | Per-agent LLM broker, model allowlist, and virtual credential | [Brokered egress](https://docs.tentaflake.dev/configuration/brokered-egress/) |
| Agent → web | Pinned `secure-research-tool` relay; retrieved content stays untrusted | [Web research](https://docs.tentaflake.dev/configuration/research/) |
| Agent → tool execution | Disposable offline worker and approval gate; runtime tools must submit to its queue | [Disposable worker](https://docs.tentaflake.dev/configuration/disposable-worker/) |
| Agent → credentials | Agenix and runtime credential loading | [Secrets](https://docs.tentaflake.dev/configuration/secrets/) |
| Agent → persistent state | Fixed-size workspace and optional separate private-state quota | [Workspace and state quotas](https://docs.tentaflake.dev/configuration/workspace-quota/) |
| Operator → host | Configured private connectivity and SSH authorization; reviewed Tailscale backend | [Private management contract](https://docs.tentaflake.dev/operations/tailscale/) |

Treat the [threat model](https://docs.tentaflake.dev/security/threat-model/) and the configuration in your own fork as the authoritative security review inputs.

`tentaflake.management` declares operator-owned private connectivity and SSH
policy. Tailscale is the only reviewed backend; the old
`tentaflake.tailscale.enable` aliases `management.enable`. Balanced requires
read-only configured capabilities and still forbids public OpenSSH. The
version-2 security manifest describes configuration, not enrollment, live
connectivity, operator-tested access or effective remote grants. Legacy or
missing management records remain unknown. Management connectivity and SSH
authorization are separate from Research Internet exit readiness. See the
[contract and migration](https://docs.tentaflake.dev/operations/tailscale/#host-contract-and-migration).

Research Internet egress requires fresh trusted observations and controller
leases; missing or stale evidence withholds readiness. The optional
`services.secureResearch.vpnObserver` is disabled by default. Operators can
select link/path evidence and WireGuard handshake/public-peer checks. Evidence,
leases and markers must remain root-protected and unwritable by agents; VPN
credentials stay on the host. Tailscale or Headscale management membership does
not provide an Internet exit, and firewall markers and region remain operator
assertions.

For a planned exit change, keep the old exit and firewall protected until the
documented drain condition, then confirm a fresh ready generation. Read the
[VPN selection and drain procedure](https://docs.tentaflake.dev/configuration/research/#vpn-readiness-selection).
Option checks and upstream WireGuard fixtures are separate from Tentaflake
real-tunnel integration and operator acceptance, which remain outstanding.

Private-state quotas bound the adapter's exact state source separately from its workspace. Existing data requires explicit offline migration and quota-aware backup/restore; activation refuses unsafe sources or a mismatched backing image. Individual quotas do not reserve aggregate host capacity. See the [quota guide](https://docs.tentaflake.dev/configuration/workspace-quota/).

[Generic OCI definitions](https://docs.tentaflake.dev/configuration/agent-adapters/#generic-isolated-workload) use the same containment with no network, model credentials, or accepted model/Research hooks. Their private root-owned instance parent is not mounted into the capsule; startup refuses symlink mount sources. Generic workloads remain stopped pending capability admission. Native shell/files execute inside the capsule; declaring a worker does not redirect them automatically. [Onboarding imports](https://docs.tentaflake.dev/configuration/agents/#add-an-agent-on-an-installed-host) validate stopped definitions without activating the host.

Declaring a worker does not prove that every native controller tool uses it.
Actual vendor startup, MCP discovery and execution routing require evidence
from the exact image. The `dev` profile permits broader authority and is not a
security boundary for untrusted, continuously running agents.

The model broker can forward bounded Chat Completions and Responses SSE only
when enabled for the exact agent; streaming is disabled by default. Its event
and output limits, deadlines, cancellation, audit admission and conservative
budget reservation do not establish acceptance of a vendor runtime. See
[streaming model responses](https://docs.tentaflake.dev/configuration/brokered-egress/#streaming-model-responses)
and the [adapter support limits](https://docs.tentaflake.dev/configuration/agent-adapters/).