Skip to navigation
Security

Enforcement Coverage and Limitations

View as Markdown

This page states precisely what APF governs in this release, so you can decide where you need other controls. Everything here reflects the main branch of the repository.

What APF Governs

PathCoverage
Sandbox creationEvery CreateSandbox gets the signed sandbox policy, overwriting any policy in the request, with provenance verified twice.
Sandbox policy changesUpdateConfig with a policy body or merge operations is denied. Refreshes receive only signed policy. Approval-mode changes are denied.
Policy proposalsAgent-authored proposals and every draft approval are denied.
Providers and profilesProvider types and profiles outside the bundle are denied. Profile deletion is denied. An imported or updated profile must match the bundle’s copy.
Outbound HTTP requestsRequests to hosts that the sandbox policy routes to apf-content-policy are decided at PRE_CREDENTIALS, with the full annotator, Cedar, and effect pipeline.
MCP tool callsA tools/call in an HTTP request body is evaluated as a tool call, and needs a capability grant.

What APF Does Not Govern

GapDetailMitigation
Responses and tool resultsAPF binds only the request operation. Response bodies, including MCP tool results, are not inspected.Inspect results in the tool path. Result controls are planned.
WebSocket messagesNot inspected.Do not route WebSocket traffic that needs content decisions until it is supported.
Hosts not routed to APFA host reachable at Layer 1 but missing from the apf-content-policy middleware entry gets no content decision.Include every sensitive host in the middleware entry.
Traffic OpenShell cannot inspectLayer 4 tcp endpoints and endpoints with tls: skip never reach APF with a body. APF always projects allow_uninspected_credentials as false.Avoid them for sensitive destinations.
Very large bodiesA body over the middleware registration’s max_payload_bytes, at most 4 MiB, never reaches APF and gets no APF record. OpenShell blocks it if the host’s middleware entry is fail_closed, and forwards it uninspected if every middleware on the host is fail_open.Use on_error: fail_closed, and keep request bodies to governed hosts under the limit.
JSON-RPC batches with tool callsDenied, because one evaluation carries one tool identity.Send tool calls individually.
Provider attachment and lifecycle RPCsAPF does not bind AttachSandboxProvider, DetachSandboxProvider, DeleteProvider, ConfigureProviderRefresh, or RotateProviderCredential. Attaching or detaching a provider changes a sandbox’s effective network policy through OpenShell’s provider layers.Restrict who may call these RPCs in OpenShell.
Per-request user identityOpenShell supplies no user subject on the middleware path, so rules cannot condition on who the agent acts for.Refer to Identity and Delegation.
Retiring a bundle before it expiresA bundle is retired by publishing a higher revision. There is no revocation list that reaches a host which has not loaded the new one.Publish the replacement at a higher revision, keep expires_at short, and remove a compromised key’s trust root.
Expiry of an active bundleNot enforced until the next restart or reload.Renew bundles well before expires_at.
Runtime version gatingruntime_compatibility is not enforced.Track OpenShell compatibility in your release process.
Audit integrityRecords are not signed or hash-chained.Ship records off the host promptly.

Bypass Prevention

APF’s decisions bind only traffic that passes through it. These controls keep an agent from going around it:

  • OpenShell mediates all egress. The sandbox’s only network path is through OpenShell’s supervisor, which enforces the projected network policy and calls APF for routed hosts.
  • Source policy cannot be changed outside a bundle. The interceptor denies direct edits, agent-authored proposals, draft approvals, and unmanaged providers and profiles, and agent policy proposals must stay disabled in OpenShell. Provider attachment is not governed, as listed above.
  • Admission fails closed. A sandbox cannot start without the signed policy and valid provenance.
  • Credentials come last. OpenShell injects credentials only after APF’s decision, so a request APF denies never carries a credential, and APF never holds one.
  • Callers are authenticated. In authenticated mode, only OpenShell’s gateway and the bound sandbox supervisor can call APF’s listeners.

Middleware Ordering

APF decides on the request body it receives. If another middleware that transforms bodies runs after APF on the same host, the request that leaves can differ from the one APF approved. OpenShell runs middleware in ascending order. Give APF’s entry the highest order among middleware that transform bodies on the same hosts, or do not combine them.

Next Steps