Runtime Cloud — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| IaCProvisioningService |
client-credentials |
factory.provisioning.read factory.provisioning.apply |
row-filter |
production |
| RuntimeCloudHost |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
production |
| ExecutionCapacityService |
client-credentials |
factory.capacity.read factory.capacity.admin factory.capacity.lease |
row-filter |
production |
| RuntimeEnvironmentService |
client-credentials |
factory.runtime.read factory.runtime.operate |
row-filter |
production |
Principles
- One identity, one path. Only the IaC runner's workload identity can change infrastructure, and only inside a provisioning run with a recorded plan; no module, agent or operator holds cloud credentials.
- Production applies are approved. A promotion's production-class approval covers its apply; baseline and reconciliation applies in production need their own; the approval binds the specification version (D21, ADR-0015).
- References, not values. Specifications and inventory hold Config Platform keys and secret references; the runner resolves them at apply time through the Secret Broker with lease-bound issuance.
- Proposals never write. Reconciliation and drift produce proposals; acceptance plans a run that goes through the same gates.
- Pools have boundaries. Internet-egress sandboxes and browser sessions run only in pools whose security boundary allows it; tenant-dedicated and customer-hosted pools exist for stricter editions; pool regions respect residency.
- Quotas only tighten. Edition → tenant → project; a quota denial is visible to the requester, never silent.
Scopes and roles
| Scope |
Grants |
Roles |
factory.provisioning.read |
specifications and runs |
Operator, Platform admin, Observer |
factory.provisioning.apply |
plan, cancel; apply through approvals |
Operator, Platform admin |
factory.runtime.read |
inventory, drift, proposals |
Requester (own project), Operator, Workspace admin, Observer |
factory.runtime.operate |
observe now; decide proposals |
Operator (production decisions are production class) |
factory.capacity.read / .admin / .lease |
pools, quotas, leases |
Platform admin, Workspace admin (tightening), runtime workers and the tool executor (leases) |
Threats and controls
| Threat |
Control |
| Agent provisions infrastructure directly |
agents have no cloud identity; the only path is the deploy-environment tool → promotion → provisioning run |
| Secret leaks through a plan or log |
references only; the runner redacts outputs marked secret; logs are artifacts with classification |
| Unapproved production change |
plan recorded; apply blocked without the approval; audit evidence per run |
| Drift exploited (an unmanaged resource) |
UnmanagedResource findings; proposals to adopt or remove; alerts on destructive drift |
| Tenant starves others |
quotas per tenant and project; PoolGrain accounting; shared pools bounded; dedicated pools for stricter editions |