Trust boundaries

This section describes what the platform enforces, where the boundaries are, and — with equal weight — what it does not enforce yet. A security document that lists only strengths is marketing.

The three zones

┌─ USER ────────────────────────────────────────────────────────────────┐
│  Browser · API client · MCP-speaking assistant                        │
└────────────────────────────────┬──────────────────────────────────────┘
                                 │ OIDC session or scoped API token
┌────────────────────────────────┴──────────────────────────────────────┐
│  CONTROL PLANE                                                        │
│  Validates intent, allocates addresses and indices, writes jobs.      │
│  Holds NO hypervisor credentials in agent mode.                       │
└────────────────────────────────┬──────────────────────────────────────┘
                                 │ outbound HTTPS, opened by the region
┌────────────────────────────────┴──────────────────────────────────────┐
│  REGION — your datacentre                                             │
│  Agent holds Proxmox and edge credentials. They never leave.          │
└───────────────────────────────────────────────────────────────────────┘

What each compromise would cost you

The useful way to read a trust boundary is to ask what an attacker gets.

Control plane compromised. The attacker gets intent data, the audit trail, and the ability to queue jobs that a region will execute. They do not get your hypervisor credentials, your edge router credentials, or a route into your network — the connection is opened from the inside and there is nothing to connect back along. They do get TLS private keys and storage cluster secrets, which are stored without application-level encryption today; see Known gaps.

Region agent compromised. The attacker gets your hypervisor. That is the worst case, and it is why the agent is a locked appliance with a narrow Proxmox token rather than root. They cannot reach another region: every control-plane endpoint verifies that the resource belongs to the region the agent’s token identifies. They cannot allocate addresses to themselves, because allocation happens centrally and a result the panel did not issue is rejected.

An appliance compromised. A load balancer or storage node has its own device identity and can fetch its own configuration. It cannot fetch anyone else’s. It has no route into the control plane beyond the two endpoints it uses.

A customer virtual machine compromised. It is a VM in a private network with firewall rules enforced at the hypervisor, outside the guest — a compromised machine cannot disable its own firewall. It has no credentials for the platform.

Three properties, stated precisely

Credentials do not travel. In agent mode the Proxmox API token and the edge router token exist only inside the region, in the agent’s environment. This is the single most important property in this document.

The control plane is the only allocator. Indices, subnets and addresses are assigned centrally in transactional SQL. The agent never invents an address. This makes concurrent provisioning correct, and it means a compromised agent cannot quietly hand itself another tenant’s range.

Queue semantics are central. Leasing, retry and backoff are enforced by the control plane, and an agent can only claim work for its own region.

Least privilege on the hypervisor

The platform asks Proxmox for a scoped API token, not root. The role deliberately excludes capabilities the product does not need — notably cluster-level system modification.

When a feature turns out to need a privilege that would widen the token, the feature is redesigned. That is not a slogan; there is a concrete case. Customer firewalls were originally applied as cluster security groups, which requires system-modification rights. The design was changed to write rules directly onto each virtual machine, keeping the token inside “manage VMs, do not change the system”. The user-visible model did not change at all.

The same rule governs node access: no SSH to hypervisors, ever — only the REST API. This has cost features, and they were given up rather than the boundary.

Where the network boundary is

Your region needs outbound HTTPS and nothing else. No inbound rule, no VPN, no jump host, no port forward. If your security policy forbids inbound connections to the datacentre, this platform does not ask you to make an exception.