Skip to main content
Security

ClawQLDefense in depth — every layer assumes the one before it can fail.

ClawQL’s security stack runs from supply chain through tool-call gates, containment, redaction, detection, and tamper-evident audit. Hardware attestation underneath is optional when the operator itself cannot be trusted.

Security hub on docs32-module curriculum
ClawQL security stack at a glance — nine layers from supply chain through tamper-evident audit, plus optional hardware foundation
Infographic of the ClawQL defense-in-depth stack grouped by before it runs, every tool call, while it runs, always, and optional hardware underneath.
Before it runs

Admit only what you can prove

Layers 1–3 in the stack.

  1. 01

    Supply chain

    Code, containers and node images: verify, sign, admit.

    • Trivy
    • Syft
    • Cosign
    • Kyverno
    • Packer
    • Ansible CIS hardening
    • Approved AMIs
    • gdp-ts compile-time proofs
  2. 02

    Model weights

    Checked against a signed manifest on every start.

    • SHA-256 manifest
    • Cosign signature
    • Init-container check
  3. 03

    Identity & scope

    Short-lived or single-use credentials, scoped identity.

    • HashiCorp Vault
    • Single-use tokens
    • Response wrapping
    • AWS secrets engine
    • EKS Pod Identity
    • IRSA
    • STS session policies
    • IdP-signed scope tokens
    • Kubernetes RBAC
    • Istio mTLS (SPIFFE)
    • Istio AuthorizationPolicy
Every tool call

Block bad calls before they run

Layers 4–5 in the stack.

  1. 04

    Tool-call gate

    Known attacks blocked before the call runs.

    • Panguard
    • Agent Threat Rules (ATR)
  2. 05

    Information-flow policy

    Data flows only where its label allows.

    • OpenAPPA
    • Deny-by-default rules
While it runs

Contain, redact, and respond

Layers 6–8 in the stack.

  1. 06

    Containment

    Isolated compute; only declared network paths.

    • Kata Containers
    • Agent Substrate microVMs
    • gVisor
    • Tetragon in-kernel blocking
    • Security groups
    • NetworkPolicy via CNI
    • Calico or Cilium
    • Egress gateway
  2. 07

    Data redaction

    Personal data removed before logs or events leave.

    • Microsoft Presidio
    • Fluent Bit log pipeline
    • Event payload redaction
  3. 08

    Detect & respond

    Sees what code actually does, then quarantines.

    • Falco
    • gVisor engine
    • In-guest sensors
    • Falco Talon
Always

Audit that cannot be silently rewritten

Write-once; any edit breaks the chain.

  1. 09

    Tamper-evident audit

    Write-once; any edit breaks the chain.

    • WORM log
    • Hash chain
    • Merkle roots
Agent model

Your agents

hold capabilities, never credentials — scopes and ATR decide what runs, not long-lived secrets in prompts.

Underneath

Hardware foundation (optional)

Watchdog off the host; attested execution.

  • NVIDIA Sentry on BlueField-4
  • clawql-tee

When the operator itself cannot be in the trust model, see clawql-tee for attested Durable Object–compatible execution.

Read the full security documentation

Golden-image pipelines, admission enforcement, and the agentic AI curriculum live on docs — this page is the stack map.

Open security hubRequest access