Chaos Engineering Platform  ·  View 20 of 21  ·  Assurance

Security — Trust Zones

Six zones, and the two separations that make the design defensible.

Editable source SVG draw.io All views
Human zone — authenticated people Service owner Tier-1 approver Facilitator Control zone — decides permission, holds no injection privilege Platform API Guardrail engine Audit log Authority zone — the only signer, separately deployed Lease issuer Kill switch Signing key Cloud KMS Target zone — the only privilege, scoped per lease Injection agent Privileged adapters netem, node actions Target workloads Evidence zone — append-only, read widely Evidence warehouse Coverage reports Break-glass zone — separately authorised Out-of-band reverter Reliability on-call OIDC, no static creds two-party approval resolve permission only sign signed, target-bound per-class authz fault applied state halt break glass force revert every action Security — Trust Zones and What Crosses Them Person or role Application we own Security / platform Data store Risk / gap synchronous The control zone can never inject and the target zone can never self-authorise. Only the authority zone signs. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • The control zone can never inject and the target zone can never self-authorise. Only the authority zone signs, and it holds the KMS key.
  • The kill switch is separately authorised and independently reachable, so it works when the rest of the platform does not.
  • Break-glass is its own zone with its own identity. Using it is abnormal by construction and always audited.

Assumptions

  • Workload identity per cluster for agents, with injection authorisation scoped to one run, one target set and one fault class.
  • No customer data in definitions, verdicts or evidence bundles; sampled request evidence redacted.

Risks

  • Privileged adapters — kernel-level network manipulation, node-level actions — are the largest standing privilege in the estate. They need a distinct authorisation and their own review cadence.
◀  The Loop That Makes It Worth Doing All views Identity Flow — Who Proves What  ▶
Solution Architecture v1.0 · Google Cloud · Reliability Architecture · 2026-09 · 21 views · 16 architecture decision records20-security-trust-zones