appendix iii — security
Security is the architecture.
Obsidura asks for a connection to your systems of record, so the burden of proof is on us. These are the principles the platform is built around - not bolted on.
- i
Least-privilege credentials
Agents reach your systems only through typed connectors with scoped, audited credentials. Credentials are minted per step with the minimum privilege that step requires and revoked on completion - there is no standing god-mode key.
- ii
Sandboxed execution
Every tool call runs in a sandboxed executor (gVisor) with per-step timeouts, retries, and idempotency keys. Executors have no network egress beyond the connector allowlist a workflow declares.
- iii
Model output is untrusted input
The runtime treats model output the way a kernel treats userspace. Structured outputs are schema-validated at every boundary; malformed responses are repaired or retried before they touch your data.
- iv
An audit log you can replay
Every action lands in an append-only, content-addressed audit log with the full prompt, tool call, and resulting diff. Any run can be replayed bit-for-bit against a snapshot of your data.
- v
Humans hold the judgment calls
When confidence drops below your threshold, the agent escalates to a human queue with the full decision trace instead of guessing. New agent versions run against shadow traffic before they ever act on production.
- vi
Deployment isolation
Run Pantheon in our managed cloud, inside a private VPC in your own AWS or GCP account, or fully air-gapped on-premises with no external calls. Your data stays in your dominion.
Found a vulnerability in this site or our platform? Email [email protected] and we will respond promptly. We ask for reasonable time to remediate before public disclosure.