Security and isolation model

An agent runs untrusted code on behalf of your tenant. Tanomis’s job is to let it act while keeping it inside a boundary: isolated from other agents, unable to reach anything you did not declare, and unable to forge its own identity or its own record.

At a glance

• Each session runs in its own sandbox with a kernel-level isolation layer, on workers that are interchangeable and hold no session identity.
• Tenants never share a gateway, a workspace, or a snapshot’s data.
• Everything an agent reaches goes through a platform-controlled path: the LLM gateway, the connector gateway, the egress proxy, the delegation broker.
• Images and golden snapshots are signed; run identity is a platform-signed assertion custodied outside the agent process.

Isolation

Boundary	How it is kept
Between sessions	A nested sandbox per session with a kernel-level isolation layer. The worker pod that hosts it is generic: session identity lives in the control plane, the workspace, and the snapshot, never in the worker.
Between tenants	Per-tenant worker pools, per-tenant LLM gateway, per-tenant trace and ledger partitions, tenant-scoped storage. A request that names another tenant is refused at the front door.
Between an agent and the platform	The agent sees /workspace and the platform’s own endpoints. Every other destination is refused unless declared and inside the tenant ceiling.

A golden snapshot, the warm-process checkpoint sessions start from, is taken over an empty workspace and contains no tenant data. The session’s own workspace is mounted into it at restore.

Every path out is governed

Path	Control
Model calls	The tenant’s LLM gateway: allowlist, metering, tracing
Tool calls	The connector gateway: manifest-declared connector and tools, current agent access, connection and account readiness, exact-call approvals
External hosts	A per-connection egress proxy: declared hosts within the tenant ceiling, public addresses only
Other agents	The delegation broker: a live grant, narrowed authority, a recorded decision

There is no direct network route from an agent to the internet or to the cluster it runs in.

Identity that cannot be forged

The invoking principal comes from the access token; the agent actor is attested by the platform with a per-run assertion custodied outside the agent process. Anything the agent process can read authenticates nothing on its own. See Identity and access.

Supply chain

Agent images are built remotely from a deterministic bundle and registered by digest. Golden snapshots are signed platform artifacts. A version’s contract is captured at registration and immutable after it. What ran is therefore what was reviewed.

Records that cannot be quietly edited

The audit ledger is append-only, hash-chained, and signed per tenant; the execution trace is kept apart under its own capture and retention policy. See Audit and evidence.

Where to go next

• Policy, approvals, and evidence
• Restrict network egress
• Data handling and retention: planned page on storage and retention.