THREAT MAP

Seven exposure paths

RISK	CONTROL	RESIDUAL RESPONSIBILITY
Raw source sent to an upstream	Pre-inference compiler plus route gate	Verify the actual outbound request with a test double
Credential or private key in context	Deterministic secret detector and BLOCK action	Maintain an authorized adversarial corpus
Identity mapping exposed to an agent	Vault credentials and reconstruction omitted from MCP	Keep application secrets outside model context
Sensitive value introduced by a model	Output guard before reconstruction	Inspect application-side post-processing
Cross-session placeholder replay	Session-bound tokens, TTL, and authenticated context	Protect storage, key files, and backups
Receipt becomes a shadow prompt log	Metadata-only schema and raw-content telemetry false	Review downstream logs and analytics
Failed privacy path is bypassed	Fail-closed Agent Skill and local_only route	Test outage, denial, and timeout behavior

VAULT CRYPTOGRAPHY

Separate purposes, authenticated mappings

AES-256-GCM encrypts reversible mappings with a random 96-bit nonce.
HKDF-SHA-256 derives separate encryption, fingerprint, and receipt-integrity keys from the master material.
Session id, placeholder, and entity type are authenticated data, binding a ciphertext to its intended context.
Receipt records form a SHA-256-linked local integrity chain; the anchor payload endpoint does not submit an onchain transaction.

DEPLOYMENT CHECKLIST

01
ISOLATE
Bind the gateway only to required private networks and place public TLS at a reviewed ingress.
02
AUTHENTICATE
Enable public mode only with rotated API credentials and exact CORS origins.
03
HARDEN
Use non-root, read-only containers, dropped capabilities, resource limits, and dedicated labeled volumes.
04
PROVE FAILURES
Test blocked secrets, local_only routes, invalid reconstruction, upstream timeout, and unsafe model output.
05
RECOVER
Back up the database and key material separately, verify integrity, and rehearse restore and rollback.
06
OBSERVE SAFELY
Measure latency, counts, and integrity without adding raw source or Vault mappings to logs.

SHARED RESPONSIBILITY

Strict schemas, deterministic controls, policy enforcement, bounded Vault, output guard, and privacy-minimized receipts.

Authorization, lawful data use, host security, identity, networking, upstream selection, backup, recovery, and incident response.

Purpose binding, route obedience, safe secret handling, output inspection, and deliberate reconstruction.

Its own processing, retention, training, regional, legal, and security behavior for the protected context it receives.