AI Agent Orchestration Platform  ·  View 28 of 32  ·  6 · Assurance and delivery

Security Zones and Trust Boundaries

Where an attacker arrives, what stops them at each boundary, and what an agent is trusted to do.

Editable source SVG draw.io All views
Untrusted · internet Business User Partner Webhook HMAC signed Injected Content in retrieved page Credential Attack token replay Perimeter · edge DDoS Protection network tier Front Door + WAF OWASP ruleset API Management OIDC · rate limit Control plane · private Registry API mTLS · workload id Policy Service signs bundles Credential Broker no secret transit Execution plane · private, no default egress Runtime Workers per-agent identity Tool Executor scoped token only Session Sandbox Hyper-V · no network Azure Firewall FQDN allow-list Data · restricted Execution Store CMK · private link Definition Store CMK · row security Key Vault HSM 90 day rotation Audit Ledger WORM · 7 years HTTPS 443 signed webhook rejected at edge mTLS + JWT mTLS + run token fenced 15 min token egress inspected private endpoint key logged Security Architecture — Trust Zones and What Crosses Them Person or role External / third party Risk / gap Security / platform Interface / broker Application we own Data store synchronous failure / alternate event / async An agent never inherits its caller's permissions. It carries its own identity, and every zone crossing is authenticated and logged. v 1.0 · owner Security Architecture · date 2026-08

The principle

  • An agent never automatically inherits its user's or its host's permissions; it carries its own identity and its own explicitly granted capabilities
  • Service-to-service communication is zero-trust: mutual TLS and a verified token on every hop, including inside the private network
  • The execution plane has no default egress; every outbound destination is on a versioned FQDN allow-list

Controls

  • Enterprise SSO with OAuth and OIDC, RBAC everywhere and ABAC on data-classification decisions
  • Customer-managed keys on the data stores, HSM-backed signing keys, 90-day credential rotation
  • Encryption in transit and at rest, tenant isolation, network controls and data-residency pinning

Threats explicitly drawn

  • Indirect prompt injection through retrieved content — mitigated by fencing and by denying tool authority to untrusted blocks
  • Token replay at the edge — mitigated by short-lived tokens, audience validation and rate limiting
  • Agent-generated code as an egress path — mitigated by a sandbox with no network route and output size caps
◀  Evaluation and Quality All views Identity and Delegation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-08 · 32 views · Microsoft Azure28-security-zones