Kaizen Trust Boundaries

Untrusted content can request work; only trusted services can authorize or execute it

Kaizen Trust Boundaries Untrusted content can request work; only trusted services can authorize or execute it Browser Input · requests + presentation · UNTRUSTED REQUESTS + CONTENT Browser Input requests + presentation External Content · connectors + uploads · UNTRUSTED REQUESTS + CONTENT External Content connectors + uploads Model Output · text + tool intent · UNTRUSTED REQUESTS + CONTENT Model Output text + tool intent Identity Boundary · validated envelope · TRUSTED AUTHORITY Identity Boundary validated envelope Query Authorization · ACL inside SQL · TRUSTED AUTHORITY Query Authorization ACL inside SQL Policy + Write Guard · budget + approval · TRUSTED AUTHORITY Policy + Write Guard budget + approval Trusted Backend · current authority · TRUSTED AUTHORITY · fail closed Trusted Backend current authority fail closed Agent Runtime · orders typed requests · CONSTRAINED EXECUTION Agent Runtime orders typed requests Code Sandbox · isolated workspace · CONSTRAINED EXECUTION Code Sandbox isolated workspace Package Runner · secretless process · CONSTRAINED EXECUTION Package Runner secretless process External Effect · approved destination · Architecture component External Effect approved destination Audit Trail · bounded evidence · Architecture component Audit Trail bounded evidence authenticate evidence only proposal only principal authorized rows admitted action credential-free admission bounded code validated package call guarded effect consequential outcome UNTRUSTED REQUESTS + CONTENT TRUSTED AUTHORITY CONSTRAINED EXECUTION Legend Backend Database Cloud Security Message bus External

Authority Never Comes From Content

  • • Bodies, queries, model text, and queue data cannot supply identity
  • • Prompt injection can change a request, not permission

Execution Is Constrained

  • • The runtime has no direct effects
  • • Member code runs in isolated workers
  • • Third-party package code receives no backend secrets

Failure Stays Closed

  • • Missing authority denies instead of degrading
  • • Denials reveal no unrelated existence
  • • Consequential outcomes enter bounded audit evidence