Security architecture
Seagull's trust model separates endpoint credentials, operator credentials, broker authority, and persistence. Authentication at one boundary does not grant unrestricted authority at another.
Implemented controls
The gateway verifies client certificates and derives agent identity from the verified leaf. The registry's replicated admission record determines tenant and admissibility. The control API requires caller certificates and certificate-bound sessions with per-request policy decisions. Query scope currently derives separately from certificate organizations. Backend listeners use the shared TLS implementation; private endpoint keys are held by a local signer provider.
Bodies, concurrent work, sessions, and detection state are bounded. Backend refusal responses avoid exposing raw driver failures, while operator logs preserve failure context. Agent diagnostics bound repeated untrusted text and avoid printing private keys.
Limits that matter
mTLS proves key possession, not endpoint integrity. A stolen authorized key remains usable until a relevant admission decision propagates or its certificate expires. Replacing a certificate does not revoke the previous one. Broker producer access can forge the records downstream components trust. Development broker/database defaults are not a production perimeter.
There is no current bootstrap-token service, live V2 agent renewal loop, signed remote policy, verified remote updater, or arbitrary response execution. These must remain visibly planned.
Read by boundary
- Trust boundaries identifies authority on each connection.
- Enrollment separates operator-mediated issuance from future bootstrap.
- PKI and mTLS describes renewal, overlap, and revocation limits.
- Authentication and authorization distinguishes control and query behavior.
- Secrets covers storage and delivery of sensitive material.
- Threat model connects concrete abuse paths to controls and gaps.
- Security invariants lists implemented and target rules.
Source evidence
Reviewed against the source baseline. Seagull-backend-v2/internal/agentidentity/identity.go · Seagull-backend-v2/internal/control/guard.go · Seagull-backend-v2/internal/hunt/scope.go · Seagull-agent-v2/internal/secrets/secrets.go.