Security Model
Zero-trust, encrypted, isolated
Every layer of RookeryOS carries its own security boundary. Sensitive capabilities are off by default and enabled deliberately, per deployment.
Defense in depth
Five layers, five boundaries
Application
JWT authentication, role-based access control, and scoped service keys. Agents never display credential values — they retrieve, use, and report.
Data
AES-256-GCM authenticated encryption with per-tenant keys held in a managed secret store. Random IV per operation; integrity verified on every read.
Network
Kubernetes network policies and per-agent namespaces. Free-tier pods are blocked from lateral movement and limited to the platform API and the internet.
Container
Hardened, minimal images: non-root users, ASLR enabled, no SUID binaries, no core dumps, and a reduced package surface.
Transport
TLS 1.3 terminated at the gateway with managed certificates and automatic HTTPS redirects across every hostname.
The Cookie Vault
Sessions, not secrets
RookeryOS never asks a client for a developer token and never stores a raw API key. Instead, a human authenticates once and the resulting session is sealed in an encrypted vault — then injected automatically on future visits.
- AES-256-GCM authenticated encryption
- Per-tenant data encryption keys in a managed secret store
- Access bound to production workloads via workload identity
- Disabled entirely for the free Navigator tier
- 1 · Human authenticates over the live browser stream
- 2 · Controller captures the active session
- 3 · Per-tenant key requested from the secret store
- 4 · Session encrypted with AES-256-GCM + random IV
- 5 · Encrypted blob persisted; auth tag verifies integrity
- → Future visits inject the session — no human needed
Operating principles
Safe by construction
Off by default
Browser, vault, and human-in-the-loop features are feature-flagged off and enabled deliberately per deployment.
Credentials are use-only
Agents retrieve, authenticate, and report an outcome. Credential values never appear in logs, responses, or model context.
Tenant isolation
Row-level tenant scoping in the database and per-agent namespaces keep one customer’s work invisible to another.
This page summarizes the platform's security architecture. For implementation detail, see the Security Model documentation.
Security questions?
We're happy to walk security and compliance teams through the architecture in detail.