Threat model
For: cluster operators and plugin authors.
This threat model describes what each part holds, what an attacker gains by taking it, and which controls limit that access. Read the known gaps alongside the boundaries before deciding which work a deployment can run.
This page is for whoever runs Orchestrator Zero, and for whoever reviews it. It names the parts of a cluster that trust each other less than fully, what each holds, what someone who takes one of them can do, and what stops them going further. It describes the code as it is now; Security model explains the controls themselves, and reporting a vulnerability gives the security contact.
Related tasks and reference
- Trust boundaries and compromise
- Harness and tool boundaries
- Known security gaps
- Origins, sequences and tool results
Previous section links
a sessions tools and its harness: Read the section.
checks on what tools return: Read the section.
dependencies: Read the section.
input from outside: Read the section.
known gaps: Read the section.
origin checks and sequence rules: Read the section.
the parts: Read the section.
what each compromise gives: Read the section.
who may call what: Read the section.