Security model

RootPilot asks for privileged read access to your entire stack. For a tool like that, transparency is a requirement rather than a courtesy, which is why this half is open. What follows is what the code actually guarantees, and where.

The invariants

Zero credential custody

Your credentials are never custodied outside your infrastructure. The runner reads them from your secret manager at boot and keeps them in memory only: never on disk, never in the image, never in the control-plane.

PII redaction at a single point

Redaction happens at the runner's edge, before any result crosses the boundary. One enforcement point, not several. See PII redaction.

Read-only at the connector layer

With the five exceptions listed below, and no others.

The enforcement point

The control-plane asks what. The runner decides whether it may. That decision lives in exactly one place, apps/runner/src/enforcement.ts, and it does three things:

1. Catalog allowlist. Only operations from the versioned catalog. Anything outside it is refused, regardless of what the control-plane asks for.
2. Strict arguments. Validated against the operation’s inputSchema, in strict mode.
3. Deadline. Enforced per operation (RUNNER_INVOKE_DEADLINE_MS, default 30 s).

That the decision lives on the runner’s side is the point: a compromised control-plane cannot request an operation the catalog doesn’t have.

The five write operations

The catalog is read-only except for five operations, all ticketing and chat:

Operation	Service
tickets.createIssue	Jira
tickets.addComment	Jira
tickets.transitionIssue	Jira
chat.postMessage	Slack
chat.createChannel	Slack

AWS, Datadog, GitHub, and everything else remain strictly read-only.

This guarantee is scoped to the runner

“Read-only” here means: the credentials you hand the runner only ever perform reads. The GitHub connector, for instance, contains not a single mutating call: no HTTP POST/PUT/PATCH, no GraphQL mutation; the only pull-request operation in the catalog is deploys.findPullRequestsForCommit, which merely finds which PR merged a given commit.

That is not the same as saying nothing in RootPilot writes to your GitHub. If the product opens a pull request for you, it does so by another route, outside this repository and outside the runner, with a credential that isn’t the one you configured here. What this page guarantees is the edge’s scope: the token the runner holds cannot write.

The human gate, in two layers

Human confirmation is defense in depth, enforced on both sides:

• Control-plane: the confirmed gate and the preview live in the write tool.
• Runner: independently of that, the runner requires confirmed: true on the invocation to execute any operation marked write in the catalog. Without it, it answers op_not_authorized.

The second exists precisely so as not to depend on the first. It is a wire-level gate.

Read-only SQL and aggregation

Three operations accept free-form queries: MongoDB aggregation, Athena, and CloudTrail Lake. They shipped with write-safety validation in the handler, not on trust:

• Aggregation pipelines containing $out or $merge are rejected.
• SQL containing DDL or DML is rejected.

Connector isolation

The ConnectorRuntime upholds four guarantees. It’s worth being precise about which are actually enforced and which are merely declared:

Guarantee	native	sidecar
Per-connector scoped secrets	enforced	enforced
Egress allowlist	declaratory	enforced
Contract conformance	enforced (in tests)	enforced
Declared-field redaction	enforced	enforced

The egress allowlist does not cover native connectors

Native connectors wrap third-party SDKs that make their own HTTP calls, outside the runtime’s reach. The egress declarations in manifests document intent, but they do not enforce it.

If you need an egress guarantee, enforce it where it’s real: your security group, your NetworkPolicy, your outbound proxy. Real mediation inside the product is a property of the sidecar mechanism.

Network surface

The runner is an outbound client, full stop. It listens on no port, exposes no health endpoint, and needs nothing opened in your firewall for ingress. The tunnel is reverse WSS with mTLS, and the certificate comes from an enrollment whose identity is proven by the platform.

What sits outside this repository

The diagnostic intelligence is closed and lives in the control-plane. That matters to your risk assessment in two ways:

• In favor: everything touching your credentials is here, auditable. The executor is the surface that matters for security, and it is open.
• Against: you cannot audit what the control-plane does with the already-redacted results it receives.

Both are honest to say.

Auditing it yourself

Some useful starting points if you’re reviewing the code:

Question	Where to look
What can be executed?	packages/protocol, the versioned catalog.
What gets refused, and how?	apps/runner/src/enforcement.ts.
What gets redacted?	apps/runner/src/redact/ and packages/core-edge/src/policy/.
How is identity proven?	apps/runner/src/enroll/attestation.ts.
Which credential does each connector ask for?	apps/runner/src/connectors/manifests/real.ts.