Prompt & Configuration Registry  ·  View 20 of 21  ·  Assurance

Security — Trust Zones

Six zones, and the arrow that is missing from the application runtime back into the control plane.

Editable source SVG draw.io All views
Corporate network — humans Prompt engineer On-call engineer Registry Console Control plane — authenticated, authorised per key namespace Config API Gate engine Authoring store Keycloak Key custody — no human read path OpenBao transit HSM seal Signer sign-only role Trust bundle published, versioned Distribution — read-only, unauthenticated read of signed content Artefact registry Pointer store Change bus Application runtime — workload identity only AI feature pod Resolver SDK SPIRE agent Evidence — write-once, readable, never mutable Audit ledger hash-chained Exposure store redacted for confidential keys OIDC over mTLS sign this digest signed bundle only SVID read verify against bundle append-only exposure, no prompt text Security — Trust Zones and What Crosses Them Person or role Application we own Interface / broker Decision point Data store Security / platform Queue / topic synchronous event / async No arrow runs from the application runtime into the control plane. A compromised app pod can read signed artefacts and nothing else. v 1.0 · owner Platform Architecture · d 2026-09

Decisions

  • A compromised application pod can read signed artefacts and nothing else. It has no credential for the authoring store, no write path to the pointer store, and no way to reach the signing key.
  • Key custody is its own zone with no human read path: the signer holds a sign-only role against OpenBao, and the key never leaves it (ADR-12).
  • Distribution serves signed content to any workload that can present a valid SVID. Confidentiality of the artefact is not the control; verifiability is.

Assumptions

  • Prompt text is source code, not a secret, unless a key is marked confidential — in which case content is readable only by the owning group and is redacted from exposure telemetry.
  • The build rejects a bundle whose content matches secret-shaped patterns; credentials are referenced by name and resolved at runtime from the secret store, never embedded.

Risks

  • A prompt is an injection surface: someone with authoring rights on a key can change what a model is instructed to do across an entire product. This is why authoring and promotion are separate grants and why every promotion has a named second approver.
  • The audit ledger is readable but not mutable by anyone including platform operators — a claim that depends entirely on Object Lock being correctly configured and on the retention policy being immutable. It should be tested, not assumed.
◀  Observability All views Identity and Signing  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Platform Architecture · 2026-09 · 21 views · 17 architecture decision records20-security-trust-zones