AI Executive Office — CXO Assistant Platform (On-Premises)  ·  View 26 of 30  ·  7 · Assurance

Security Zones

Where an attacker arrives, what stops them, and what they would actually get if they took the orchestrator.

Editable source SVG draw.io All views
Internet — untrusted Executive device MDM compliant Attacker credential · injection Chat and mail Mattermost · SMTP Perimeter — public ingress ends here HAProxy + WAF OWASP CRS · limits Perimeter firewall Keycloak MFA · device policy Application — cluster-internal, no route from outside Kong internal no public route Experience API workload identity Orchestrator no data credential Tool plane MCP · the only door AI and data — mesh-internal, keys in the HSM vLLM serving no egress OpenSearch ACL fields Decision store encrypted · Vault key Trino + MinIO catalogue RBAC Vault + HSM per-tenant key Execution and egress — the only outbound path Execution plane write scopes only Egress firewall FQDN allow-list Enterprise systems over the MPLS link Management — separate identities, no standing access JIT admin access approval + time box Bastion OpenSearch SIEM SIEM · UEBA Falco + Trivy runtime · posture TLS 1.3 blocked at the edge mTLS mesh typed call only caller identity allow-listed FQDN private Security Zones — Where an Attacker Arrives, and What Stops Them Person or role Risk / gap External / third party Interface / broker Security / platform Application we own Data store synchronous failure / alternate The orchestrator holds no credential for any store. Compromising it yields the ability to ask questions as the caller, and nothing more. v 1.0 · owner Data & AI Global Practice · date 2026-09

The blast-radius argument

  • The orchestrator holds no credential for any store. Compromising it yields the ability to ask questions as whoever is calling, and nothing more. That is the point of putting the tool plane in a separate zone
  • Public ingress ends at the perimeter. Every service behind it is private-endpoint only, and administrative access has no standing privilege
  • Egress has exactly one path, through a firewall with an FQDN allow-list. A model that has been talked into exfiltrating data has nowhere to send it
  • Only first-party MCP servers run inside the boundary. A third-party or remotely hosted server would be someone else’s code deciding what the model sees and what a tool description says — an injection path with a standards logo on it

The threats this addresses

  • Prompt injection through a retrieved document, treated as the primary AI-specific threat: retrieved content is data, never instruction, and the model has no write tool to be talked into using
  • Credential theft of an executive account: conditional access, device compliance and MFA, and the platform inherits the account's authority rather than exceeding it
  • The operator as a threat: break-glass access that is requested, approved and time-boxed, no standing administrator, and telemetry that excludes content

Risks

  • The tool plane is now the single most security-critical component in the platform. It is small by design, changes rarely, and every tool contract change goes through security review
◀  Degradation Contract All views Identity and Authorisation  ▶
Solution Architecture v1.1 · fully on-premise, open source, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0926-security-zones