Security by Design
OpenFlows' security is not a list of patches bolted onto the product — it falls out of the architecture. This page walks through the properties that make the system safe by construction, and the mechanisms that back each one.
The foundation: keep secrets out of the sandbox
The single most important decision is that worker workspaces hold no secrets and no credentials:
- No LLM keys. Every AI call happens centrally through the model gateway in the control plane. There is no model key inside any workspace for a compromised agent to read or exfiltrate.
- No raw repository credentials. Git identity flows through a scoped OAuth link per tenant, not a shared token dropped into a sandbox.
- No agent framework. The intelligence runs centrally; the workspace hosts only a thin coordination surface.
Remove the secrets from the sandbox and an entire class of "stolen key" attacks disappears.
Defense in depth
Beyond keeping secrets out, each risk has its own control:
| Property | How it's enforced |
|---|---|
| Key exfiltration | No keys in workspaces; models only reached through the central gateway |
| Identity | Real per-user login; every agent action inherits a real, attributable identity |
| Network isolation | Workspaces can reach only the control plane, GitHub, and the store — everything else denied |
| Command control | Agents must get approval before acting where it matters; only safe commands are permitted for verification |
| Review integrity | Builder and reviewer never share a filesystem; review happens at a distance |
| Gate integrity | Approvals are single-use and only the reviewer can create them; an agent can’t approve its own work |
| Audit | Every step is a typed, recorded event, plus a full platform audit log |
| Multi-tenant isolation | Separate identity + separately namespaced coordination state |
The review is trustworthy because it's isolated
The adversarial review only means something if SENTINEL can't be fooled or coerced by FORGE. Isolation buys this:
- SENTINEL never touches FORGE's filesystem.
- SENTINEL asks FORGE to run a safe, allowlisted command and reads the evidence — it never gets shell access to FORGE's tree.
- A verification result that wasn't durably recorded cannot approve a gate.
"When in doubt, don't approve"
The review posture is deliberately strict: if the required evidence is missing or unreadable, the reviewer must not approve — it holds the ticket or escalates rather than guessing. This one principle is worth more than any individual control, because it means the system would rather block than merge something unverified.
Trust is concentrated, not spread
- One long-lived, trusted component holds credentials and supervises: the orchestrator workspace.
- Everything else is disposable, keyless, and tightly firewalled.
Instead of sprinkling trust across many long-lived pieces, OpenFlows concentrates it in a single auditable place and keeps the rest ephemeral.
Auditability as a feature
For companies, "AI delivery" needs to stand up to review. Because every planning approval, review verdict, and merge is a typed, recorded event with an attributable identity, you can answer "what was the team doing, and why?" with a concrete trail — not a black box.
The result