Authority
- Advise is the default; no approval means no Permit. A rejected proposal never gets a Permit. Only signed-in operators authorize; API keys cannot.
- Authority binds the exact action. The authorization records the canonical action hash. A modified action needs a new approval and a new Permit; a Permit for A can never execute B — the Executor applies only the signed bytes.
- Auto fails closed. An empty or default policy authorizes nothing. In-policy authorizations record the policy id, version, scope and rule. Outside the policy, the change returns to a human.
- A policy change revokes and versions. Permits issued under the old version are revoked; nothing is re-authorized silently under the new one.
- No standing authority. Enabling execution approves nothing; reading never implies writing; the execution role carries no AWS permissions and the Kubernetes identity holds only
get/list/patchin your namespaces.
The Permit
- Offline validity is not authority. Signature, issuer, audience, lifetime, binding and hash are verified offline — and then revocation and single use are enforced online, at consume, before any write.
- Consume is the commit point. No AWS call and no Kubernetes write happens before a successful consume; this is checked dynamically and by a source scan. Revoke-versus-consume on the same Permit has exactly one winner.
- Single use under concurrency. Twelve concurrent consumes yield one winner. Replay is refused; the same attempt re-delivering its claim is idempotent.
- Expired and revoked Permits are refused even though their signatures still verify. Retiring a signing key never revives anything.
- The exact token, or nothing. Consume binds the SHA-256 of the token ChangeGuard issued; a differently encoded token with a valid signature is refused.
- Environment and executor are bound. A swapped endpoint never reaches AWS; a role bound to another environment, tenant or account is refused even when its name matches; the Local Executor serving one environment is never served another’s work.
- History is never rewritten. Signed fields are immutable; status only moves out of
issued; events are append-only.
What may be changed at all
- Server-side field allowlist. Every manifest patch — model-generated or not — is validated against an allowlist of safe operational fields (resources, replicas, environment variables, probes, and similar). Patches that touch identity or metadata are rejected. The Executor re-checks the same allowlist and refuses exec probes.
- Manifest patches only. Code-level fixes are never executed automatically, in any mode, under any policy.
- One remediation per workload at a time. While any remediation or rollback is in flight for a workload, further apply requests are refused.
What happens when a fix is wrong
- No un-undoable writes. Pre-state is captured read-before-write before the first apply; if it cannot be recorded, the Executor refuses to execute. See Compensating actions.
- Drift refusal. If the touched fields changed since the remediation (a human intervened), the rollback stops rather than overwriting — preserving the human’s change and escalating.
- Exactly one compensating action, under its own authority and its own Permit — no retry loops, no rollback-of-a-rollback — and a rollback terminal state always leaves the incident
escalated, never silently resolved. - VERIFIED requires observation. No fresh evidence, no VERIFIED. Still unhealthy after the window → failed. A silent attempt is
unreported, failed and escalated — never assumed to have worked.