Security in this plane is mostly a property of construction: tools only execute inside the MCP sandbox, the sandbox is ephemeral and restricted, and the entire plane runs inside your perimeter. This document specifies the sandbox lifecycle, the threats the model answers, and the sovereignty posture.
The sandbox lifecycle
provision ──▶ fetch tool ──▶ execute ──▶ destroy
│ │ │
restricted verified network-limited
container tool code filesystem-restricted
download| Stage | Semantics |
|---|---|
| Provision | An isolated container is created for this execution |
| Fetch | The MCP tool's code is downloaded into the container |
| Execute | The tool runs with restricted network and filesystem access |
| Destroy | The container is destroyed immediately after execution — nothing persists |
The unit of isolation is the call: one container per tool execution, no reuse across steps, no state carried between executions.
Threat matrix
| Threat | Stopped by |
|---|---|
| Prompt injection attempting to exfiltrate data | Network-restricted sandbox — the exfiltration call cannot leave |
| A compromised tool writing to the host | Filesystem restriction — the write has nowhere to land |
| An agent inventing a tool or parameters | The input schema gate — the call is never made |
| A disallowed action on an external system | Cedar evaluation — DENY halts before execution |
| Credential capture through logs | Credentials never enter the Evidence Ledger; runtime injection only |
| Data leaving the perimeter | Air-gapped deployment — see below |
Data sovereignty
| Environment | Posture |
|---|---|
| Staging | The plane runs locally in your staging environment |
| Production | Deployed into your VPC through containerized templates |
| Egress | Zero — your workflows, tools, and data do not leave your perimeter |
Your SOPs, Cedar policies, MCP tool definitions, and evidence all live and run inside the perimeter. The delivery model is white-glove: the plane comes to you; nothing of yours goes to it.
Credential handling
Credentials — LLM API keys, tool authentication — are yours and stay yours. They are injected at runtime into the execution context, and the redaction rule is structural: the ledger records that a call was made with evaluated parameters; it never records the credential material used to make it. An auditor can verify every decision the plane made without ever handling a secret.