Security boundaries

tentaflake separates configuration, credentials, network access, tool execution, and persistent state into explicit boundaries. The controls are composable, but no single control makes an untrusted agent safe.

Boundary map

Boundary	Mechanism	Review next
Agent process → host	Hardened container and systemd policy	Threat model
Agent → internet	Brokered egress and provider allowlists	Brokered egress
Agent → host tools	Disposable worker and approval gate	Disposable worker
Agent → credentials	Agenix and runtime credential loading	Secrets
Agent → persistent state	Dedicated workspace and quota	Workspace quota
Operator → host	Tailscale management policy	Tailscale

Treat the threat model and the configuration in your own fork as the authoritative security review inputs.