Model & Compute — Security¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Credentials¶
Provider credentials exist only in ModelGatewayHost, brokered per deployment as short-lived credentials from the Secret Broker (BC-40) and never configured on runtime workers, in prompts, events, manifests or logs. The caller's workload identity, the user's delegated scope and the provider credential are three different things and are never merged.
Privacy classes¶
| Class | Meaning | Allowed fallback |
|---|---|---|
| TenantPrivate | self-hosted or dedicated capacity inside the tenant boundary (pii-local) |
TenantPrivate only |
| Regional | provider deployment pinned to the tenant's region (D31) | Regional or TenantPrivate |
| External | commercial provider outside the region | only where tenant policy allows |
The policy engine decides per invocation from the profile's class, the data classification of the request and the tenant's policy; the router filters before scoring. A fallback never crosses to a less private class.
Policy before provider¶
Every invocation carries a policy decision id; a missing or failed decision fails the call closed. Model and tool permissions declared at publication are enforced here for models and in the Tools & MCP platform for tools; the gateway refuses tool definitions outside the release's closure.
Content handling (D31)¶
Prompts and responses are never stored in model-sql, logged or put on spans; outputs are artifacts by hash under the tenant's retention. Prompt caching uses provider-side caches keyed by hash; LogContent is a non-reloadable option that is never true in production.
Prompt-injection posture¶
The gateway cannot be instructed by content: profile, route plan, policy decision and tool closure are inputs from trusted services, not from the prompt. Retrieved content reaches the model as data with provenance tags from Knowledge; the technology radar tracks output validation and guardrail practice.
Compute pools¶
Pool endpoints are reached with brokered credentials; tenant-owned pools (hybrid-compute) are rows of that tenant and only that tenant's deployments may be placed on them. The security boundary of a pool is a registration fact that placement never relaxes.
Audit¶
Deployment registration, evaluation, approval, retirement, profile activation and retirement, fallbacks and pool state changes are consumed by AuditService; receipts are the evidence for every call.