Public ingress ends at the perimeter. The application and data zones have no public endpoint at all, and every managed service is reached over Private Link, so a leaked credential is not by itself a path to data.
Data-plane keys are disabled everywhere they can be: Cosmos account keys off, Service Bus SAS off, Storage anonymous access off, all replaced by Entra RBAC. There is nothing in the cluster to steal (view 28).
The worker namespace is the most constrained zone in the design, because it is where third-party handler code runs. Network policy denies east-west traffic and all egress is FQDN-filtered through Azure Firewall.
Controls
TLS 1.3 in transit everywhere, customer-managed keys at rest on Cosmos, Blob and SQL, HSM-backed keys in Key Vault with purge protection.
Operator roles requiring destructive access are PIM-eligible only: just-in-time, approval-gated, 4-hour maximum. There is no standing permission to terminate an execution.
Audit events export to immutable WORM Blob for 7 years, separate from the Log Analytics workspace so an operator with log access cannot alter the audit trail.
Where an attacker arrives
A stolen client credential is the most likely entry. It is bounded by tenant claim, APIM quota and per-tenant RBAC, so it buys the ability to submit that tenant's workflows and nothing else.
A malicious or compromised task handler is the highest-impact scenario, because it runs inside the cluster. Egress allow-listing, network policy and per-task scoped tokens are what bound it, and handler supply chain is signed and attested in view 23.
Task payloads may carry personal data, so classification travels with the workflow definition: a task marked restricted may only bind to handlers whose egress FQDNs are approved for that classification.
