# Security and isolation model

How agents are isolated from each other and from the platform, how tenants are kept apart, and what is signed.

An agent runs untrusted code on behalf of your tenant. Tanomis's job is to let it act while
keeping it inside a boundary: isolated from other agents, unable to reach anything you did not
declare, and unable to forge its own identity or its own record.

- Each session runs in its own sandbox with a kernel-level isolation layer, on workers that are
  interchangeable and hold no session identity.
- Tenants never share a gateway, a workspace, or a snapshot's data.
- Everything an agent reaches goes through a platform-controlled path: the LLM gateway, the
  connector gateway, the egress proxy, the delegation broker.
- Images and golden snapshots are signed; run identity is a platform-signed assertion custodied
  outside the agent process.

## Isolation

| Boundary | How it is kept |
|---|---|
| Between sessions | A nested sandbox per session with a kernel-level isolation layer. The worker pod that hosts it is generic: session identity lives in the control plane, the workspace, and the snapshot, never in the worker. |
| Between tenants | Per-tenant worker pools, per-tenant LLM gateway, per-tenant trace and ledger partitions, tenant-scoped storage. A request that names another tenant is refused at the front door. |
| Between an agent and the platform | The agent sees `/workspace` and the platform's own endpoints. Every other destination is refused unless declared and inside the tenant ceiling. |

A golden snapshot, the warm-process checkpoint sessions start from, is taken over an empty
workspace and contains no tenant data. The session's own workspace is mounted into it at restore.

## Every path out is governed

| Path | Control |
|---|---|
| Model calls | The tenant's LLM gateway: allowlist, metering, tracing |
| Tool calls | The connector gateway: manifest-declared connector and tools, current agent access, connection and account readiness, exact-call approvals |
| External hosts | A per-connection egress proxy: declared hosts within the tenant ceiling, public addresses only |
| Other agents | The delegation broker: a live grant, narrowed authority, a recorded decision |

There is no direct network route from an agent to the internet or to the cluster it runs in.

## Identity that cannot be forged

The invoking principal comes from the access token; the agent actor is attested by the platform
with a per-run assertion custodied outside the agent process. Anything the agent process can read
authenticates nothing on its own. See [Identity and access](/concepts/identity-and-access).

## Supply chain

Agent images are built remotely from a deterministic bundle and registered by digest. Golden
snapshots are signed platform artifacts. A version's contract is captured at registration and
immutable after it. What ran is therefore what was reviewed.

## Records that cannot be quietly edited

The audit ledger is append-only, hash-chained, and signed per tenant; the execution trace is kept
apart under its own capture and retention policy. See
[Audit and evidence](/guides/audit/audit-and-evidence).

## Where to go next

- [Policy, approvals, and evidence](/concepts/governance)
- [Restrict network egress](/guides/govern/restrict-network-egress)
- [Data handling and retention](/guides/govern/data-handling): planned page on storage and
  retention.