1"use strict";(self.webpackChunkdocs_site=self.webpackChunkdocs_site||[]).push([["1373"],{3740(e,n,t){t.r(n),t.d(n,{metadata:()=>i,default:()=>p,frontMatter:()=>a,contentTitle:()=>s,toc:()=>d,assets:()=>l});var i=JSON.parse('{"id":"security/known-limitations","title":"Known limitations","description":"Last reviewed: 2026-09-06","source":"@site/docs/security/known-limitations.md","sourceDirName":"security","slug":"/security/known-limitations","permalink":"/security/known-limitations","draft":false,"unlisted":false,"editUrl":"https://github.com/AgentPaaS-ai/docs/edit/main/docs/security/known-limitations.md","tags":[],"version":"current","frontMatter":{"id":"known-limitations","title":"Known limitations","sidebar_label":"Known limitations"},"sidebar":"docs","previous":{"title":"Trust model","permalink":"/security/trust-model"},"next":{"title":"Data handling","permalink":"/security/data-handling"}}'),r=t(4848),o=t(8453);let a={id:"known-limitations",title:"Known limitations",sidebar_label:"Known limitations"},s,l={},d=[{value:"Composition and workflow",id:"composition-and-workflow",level:2},{value:"Cloud data-plane assurance",id:"cloud-data-plane-assurance",level:2},{value:"Long-running and routed runs",id:"long-running-and-routed-runs",level:2},{value:"Network enforcement",id:"network-enforcement",level:2},{value:"HTTP proxy only (no transparent proxy for non-HTTP)",id:"http-proxy-only-no-transparent-proxy-for-non-http",level:3},{value:"llm_provider_lock restricts agent.llm() only",id:"llm_provider_lock-restricts-agentllm-only",level:3},{value:"Supply chain and signing",id:"supply-chain-and-signing",level:2},{value:"Rebuilt images differ from the publisher's",id:"rebuilt-images-differ-from-the-publishers",level:3},{value:"No revocation",id:"no-revocation",level:3},{value:"Plugin consent gate is client-side",id:"plugin-consent-gate-is-client-side",level:3},{value:"Audit integrity",id:"audit-integrity",level:2},{value:"Hash-chain record deletion detection",id:"hash-chain-record-deletion-detection",level:3},{value:"Production hardening",id:"production-hardening",level:2},{value:"CAP_NET_ADMIN: capability dropped after firewall programming",id:"cap_net_admin-capability-dropped-after-firewall-programming",level:3},{value:"Checkpoint key encrypted at rest",id:"checkpoint-key-encrypted-at-rest",level:3},{value:"Platform support",id:"platform-support",level:2},{value:"Additional honesty statements",id:"additional-honesty-statements",level:2},{value:"Related",id:"related",level:2}];function c(e){let n={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.p,{children:"Last reviewed: 2026-09-06"}),"\n",(0,r.jsx)(n.p,{children:"This page records accepted trade-offs and capability gaps in the current\nrelease. A listed gap must not be mistaken for a shipped, operator-ready\nfeature merely because a design or specification exists."}),"\n",(0,r.jsxs)(n.p,{children:["For the full security posture, see the ",(0,r.jsx)(n.a,{href:"./threat-model",children:"threat model"}),". For\nauthoring guidance, see ",(0,r.jsx)(n.a,{href:"./how-enforcement-works",children:"How enforcement works"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"composition-and-workflow",children:"Composition and workflow"}),"\n",(0,r.jsx)(n.p,{children:"Cloud workflow envelopes are the multi-step path (linear, fan-out join-all,\nchoice, phone-call). A single agent does not need a workflow. Native\nhuman-in-the-loop, join-any, for-each, wait/delay, spawn deeper than one, and\nstandalone agent-to-agent calls are not shipped."}),"\n",(0,r.jsx)(n.h2,{id:"cloud-data-plane-assurance",children:"Cloud data-plane assurance"}),"\n",(0,r.jsx)(n.p,{children:"AgentPaaS Cloud runs on a Cloudflare-only data plane. On the default tier,\negress and topology are enforced at the per-instance egress boundary through\nthe AgentPaaS control plane and gateway. The default tier does not claim\nsubstrate-enforced isolation."}),"\n",(0,r.jsx)(n.p,{children:"Substrate-enforced isolation (kernel-enforced network policy, independent of\nour code) is reserved for the high-assurance Kubernetes tier (paid, on\ndemand). Cloud scope limits: HTTP/S egress only (no non-HTTP protocol\ngovernance), and no external agent-to-agent federation."}),"\n",(0,r.jsx)(n.h2,{id:"long-running-and-routed-runs",children:"Long-running and routed runs"}),"\n",(0,r.jsx)(n.p,{children:"The current shipped path has one configured provider/model/credential target.\nGaps not yet closed include: immutable deployment versions and atomic\npromotion/rollback; durable invocation idempotency; a single authoritative\ntime model; policy-derived worker CPU/process limits; first-class\nconversation/session state; logical route selection across a model pool;\nautomatic cross-model fallback; a shared hard LLM spend limit across workflow\nstages; explicit worker attempts, leases, and fencing; operator cancel and\nsafe-boundary pause/resume; and deterministic no-progress recovery guardrails."}),"\n",(0,r.jsx)(n.p,{children:"Model timeout, quota, authentication, context, or subscription failures can\ntherefore fail the worker. These gaps close across cumulative releases; no\nintermediate state should be presented as shipped long-running routed-run\nsupport."}),"\n",(0,r.jsx)(n.h2,{id:"network-enforcement",children:"Network enforcement"}),"\n",(0,r.jsx)(n.h3,{id:"http-proxy-only-no-transparent-proxy-for-non-http",children:"HTTP proxy only (no transparent proxy for non-HTTP)"}),"\n",(0,r.jsxs)(n.p,{children:["Outbound policy enforcement routes agent HTTP/HTTPS traffic through the\ngateway via ",(0,r.jsx)(n.code,{children:"HTTP_PROXY"})," / ",(0,r.jsx)(n.code,{children:"HTTPS_PROXY"}),". Non-HTTP protocols (raw TCP, UDP,\nICMP) are blocked by internal-net
1work isolation, not by deep packet\ninspection. A transparent proxy for all protocols is deferred."]}),"\n",(0,r.jsx)(n.h3,{id:"llm_provider_lock-restricts-agentllm-only",children:"llm_provider_lock restricts agent.llm() only"}),"\n",(0,r.jsxs)(n.p,{children:["The ",(0,r.jsx)(n.code,{children:"llm_provider_lock.allowed_endpoints"})," field restricts the LLM route path. It\napplies only to ",(0,r.jsx)(n.code,{children:"agent.llm()"})," calls. An agent can reach a non-approved LLM\nprovider via ",(0,r.jsx)(n.code,{children:"agent.http(...)"})," if that provider's domain is in the egress\nallowlist. This is defense-in-depth, not a primary control. Egress policy is\nthe primary restriction. To fully lock LLM calls to a provider, also remove\nother LLM provider domains from the egress list."]}),"\n",(0,r.jsx)(n.h2,{id:"supply-chain-and-signing",children:"Supply chain and signing"}),"\n",(0,r.jsx)(n.h3,{id:"rebuilt-images-differ-from-the-publishers",children:"Rebuilt images differ from the publisher's"}),"\n",(0,r.jsxs)(n.p,{children:["When a receiver installs a bundle without ",(0,r.jsx)(n.code,{children:"--prefer-image"}),", the container\nimage is rebuilt locally from source and the image digest will differ from the\npublisher's. The source digest, lock signature, and policy digest are verified\n, but the image itself is not byte-identical. Use ",(0,r.jsx)(n.code,{children:"--prefer-image"})," with a\ncosign-signed image for identical reproduction."]}),"\n",(0,r.jsx)(n.h3,{id:"no-revocation",children:"No revocation"}),"\n",(0,r.jsxs)(n.p,{children:["There is no revocation mechanism in the current release. A stolen publisher\nkey can sign valid bundles until the receiver manually removes trust\n(",(0,r.jsx)(n.code,{children:"agentpaas trust remove <fingerprint>"}),")."]}),"\n",(0,r.jsx)(n.h3,{id:"plugin-consent-gate-is-client-side",children:"Plugin consent gate is client-side"}),"\n",(0,r.jsxs)(n.p,{children:["The Hermes plugin's consent enforcement (no auto-approve, terminal-only\ninstall) is a client-side policy. A user could bypass it by running\n",(0,r.jsx)(n.code,{children:"agentpaas install"})," directly. This is by design because the user owns their machine.\nThe plugin prevents LLM-mediated auto-approval, not user-mediated manual\napproval."]}),"\n",(0,r.jsx)(n.h2,{id:"audit-integrity",children:"Audit integrity"}),"\n",(0,r.jsx)(n.h3,{id:"hash-chain-record-deletion-detection",children:"Hash-chain record deletion detection"}),"\n",(0,r.jsx)(n.p,{children:"Truncating the last N records from an exported JSONL audit file leaves a valid\nprefix chain. Post-export tampering (deletion) cannot be detected on a second\nmachine without an external anchor. The audit checkpoint signing key is\nencrypted at rest (AES-256-GCM), and signed checkpoint export provides tamper\nevidence when anchored externally."}),"\n",(0,r.jsx)(n.h2,{id:"production-hardening",children:"Production hardening"}),"\n",(0,r.jsx)(n.h3,{id:"cap_net_admin-capability-dropped-after-firewall-programming",children:"CAP_NET_ADMIN: capability dropped after firewall programming"}),"\n",(0,r.jsxs)(n.p,{children:["The agent container's iptables egress firewall is ",(0,r.jsx)(n.strong,{children:"defense-in-depth"}),". The\n",(0,r.jsx)(n.strong,{children:"primary"})," egress control is network topology isolation (internal-only\nnetwork, no default route to the internet). After programming the firewall,\nthe runtime removes CAP_NET_ADMIN from the process before the worker starts.\nIf iptables is unavailable or a rule fails, the runtime logs a warning and\ncontinues; topology isolation remains the hard boundary."]}),"\n",(0,r.jsx)(n.h3,{id:"checkpoint-key-encrypted-at-rest",children:"Checkpoint key encrypted at rest"}),"\n",(0,r.jsx)(n.p,{children:"The ECDSA P-256 audit checkpoint signing key is stored encrypted\n(AES-256-GCM, passphrase via PBKDF2-HMAC-SHA256, 100K iterations), sourced\nfrom the macOS Keychain or a 0600 passphrase file."}),"\n",(0,r.jsx)(n.h2,{id:"platform-support",children:"Platform support"}),"\n",(0,r.jsx)(n.p,{children:"The local runtime targets macOS with Docker Desktop or Colima. Linux-native\nsupport is unavailable in the current release. AgentPaaS Cloud runs Linux\ncontainers on the managed data plane."}),"\n",(0,r.jsx)(n.h2,{id:"additional-honesty-statements",children:"Additional honesty statements"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Container hardening, not a kernel 0-day sandbox."}),"\n",(0,r.jsx)(n.li,{children:"Outbound DLP is fingerprint-based, not semantic."}),"\n",(0,r.jsx)(n.li,{children:"Security testing does not replace your own review of agent code, dependencies,\npolicies, and destinations."}),"\n",(0,r.jsx)(n.li,{children:"Local mode trusts the developer's machine. We protect against the agent,\nnot against the user."}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"related",children:"Related"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"./threat-model",children:"Threat model"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"./how-enforcement-works",children:"How enforcement works"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"./audit-export",children:"Audit export"})}),"\n"]})]})}function p(e={}){let{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},8453(e,n,t){t.d(n,{R:()=>a,x:()=>s});var i=t(6540);let r={},o=i.createContext(r);function a(e){let n=i.useContext(o);return i.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.