CASAN Trust Boundaries

Trust model

CASAN separates enforcement, evidence, identity, execution isolation and external trust. Passing one boundary never implies that another passed.

Boundary	Development/local	Production/strict
Control Plane identity	Explicit loopback local identity	In-process RS256 JWT verification required
H2 tool authority	Enforce defaults on; explicit bypass is high-severity/non-certifiable	Enforce on; bypass configuration rejected
H5 high-impact action	Approval and actor required by action floor	Strict signed approval plus external trust requirements
Tool isolation	Static fallback only when explicitly enabled in dev/test	Container isolation required; unavailable backend denies
Audit signing	Local OpenSSL permitted and labelled local	Vault/KMS external signing required
Immutable anchor	Local hash chain permitted and labelled local	External Object Lock/WORM provider required
Certification	Local/observed limitations disclosed	Unsafe fallback or emergency override cannot normally certify

H2 enforcement dependency

H2 returns a structured PolicyDecision, never a boolean-only decision. Missing file, unreadable file, timeout, malformed protocol, missing runtime and internal execution errors have stable reason codes. In enforce mode all dependency errors deny. In observe mode the operation may be observed, but assurance is degraded and certification is forbidden.

Registry enforcement defaults on for side-effecting native and Agentic Bridge paths. CASAN_H2_REGISTRY=0 or CASAN_AGENTIC_H2_REGISTRY=0 is an explicit unsafe development/test bypass. Production treats the bypass as invalid.

H5 governance and action risk

config/action-classes.json is the common policy source. Effective risk is the maximum of content, action, resource, identity and environment factors. Deployment, release, migration, database mutation, delete, identity/permission modification and infrastructure modification cannot be downgraded by benign wording. Credential access and unknown commands are also high-risk. High-impact operations require actor identity, approval and evidence.

Production governance requires strict approval and external signing/anchor capability. Governance audit format v2 binds action class, risk factors and evidence requirements into the hash. The verifier continues to recognize legacy v1 records without upgrading their claims.

Execution isolation

sandbox-run.sh detects its selected capability and writes structured sandbox evidence. In enforce/production mode a side-effecting path requires the container backend. If Docker or the required backend is unavailable, execution is denied with sandbox_isolation_backend_unavailable; there is no silent timeout/static fallback.

The implemented container contract uses:

Read-only root filesystem.
Explicit workspace bind mount as the writable scope.
Network disabled by default.
Non-root container user.
Dropped Linux capabilities and no-new-privileges.
PID, memory, CPU and timeout limits.
Restricted working directory and filtered environment.
Output-size and exit-code capture at the harness boundary.
Rootless Docker requirement in production.

CASAN does not claim AppArmor, SELinux, a custom seccomp profile, per-domain network allowlisting or complete host isolation where those mechanisms are not configured. Development static fallback is policy filtering, not isolation.

Control Plane identity boundary

Arbitrary X-CASAN-*, X-Forwarded-User and similar headers are untrusted. Nginx removes them, oauth2-proxy provides a signed access token, and the API verifies the token before creating VerifiedClaims. A non-loopback local mode or an invalid production verifier refuses startup.

Signing and immutable evidence boundary

Local SHA-256 chains and evidence digests provide tamper detection under the local host's trust. They are not externally trusted immutability. Normal production certification requires both:

CASAN_SIGNING_PROVIDER=vault_kms (or another explicitly supported external trust provider) with an HTTPS endpoint and short-lived credential.
CASAN_IMMUTABLE_ANCHOR_PROVIDER=s3_object_lock (or an explicitly supported external WORM provider) with bucket and KMS configuration.

The packaged production path verifies Vault Transit readiness and performs an S3 Object Lock COMPLIANCE anchor write. It does not provision either service.

CASAN_TRUST_EMERGENCY_OVERRIDE=1 is break-glass behavior. It emits critical evidence, keeps readiness failed and makes the run non-certifiable. It is not a normal production fallback.

Secret and evidence handling

Raw JWTs and authentication secrets are not logged.
Tool and prompt evidence remains subject to existing redaction/scanning.
Authentication evidence records identity metadata and stable reason codes.
Canonical evidence digests detect local metadata tampering, while external signing/anchoring supplies production trust.
A successful evidence append never changes a failed execution into success.

Infrastructure not proven by repository tests

Repository-local tests use cryptographic fixtures and narrow service stubs. Docker isolation tests are skip-aware when Docker is absent. Real enterprise OIDC traffic, Vault policy enforcement, KMS/HSM custody, S3 retention policy, rootless Docker host hardening and managed network controls require deployment evidence before production claims are made.

5.4 KiB Raw Blame History