Defense in depth is the first security principle of the platform: every layer applies its own control. The WAF filters obvious SSRF, for example, but the egress guard revalidates every resolved address at connection time, and Cilium refuses the cloud metadata address anyway.
From the browser to the API
The portal sends a Content Security Policy with a nonce and filters links with safeHref. Traffic from the Internet then reaches the APISIX gateway over TLS, where the Coraza WAF applies the OWASP Core Rule Set. Behind it, the Control Plane API enforces size limits, rate limiting, authentication, role checks and tenant isolation.
Deny by default on the network
The cluster network is default deny with Cilium, DNS included at layer 7. Outbound HTTP to private addresses is refused unless explicitly allowed, and the egress guard connects to the address it validated, which defeats DNS rebinding. Cloud metadata and link-local addresses are blocked without exception, and redirects are never followed.
Tenant isolation and secrets
Every tenant table is protected by PostgreSQL row level security, forced on each table: even a connection that owns the tables only sees what the policies allow, and a resource of another tenant answers 404. Secrets live in OpenBao or are encrypted with the master key: tools, MCP servers and connectors receive references, never the clear value in the prompt.
Untrusted content and sensitive data
- Prompt injection detection on documents, tool results and web pages, with untrusted content wrapped with a nonce.
- Output guard on model answers: link and image filtering, and a canary in the system prompt.
- DLP Gateway built on Presidio: detect, mask, tokenize or block sensitive data before it reaches a model.
- A startup guard that refuses a dangerous production configuration.
No layer assumes that the previous one has done its job.