diff --git a/docs/2-handbook/trust-boundary/security.md b/docs/2-handbook/trust-boundary/security.md index 68efd23b..ff31a314 100644 --- a/docs/2-handbook/trust-boundary/security.md +++ b/docs/2-handbook/trust-boundary/security.md @@ -2,8 +2,8 @@ ## Agent trust model -The sections below document specific mechanisms (nixbld isolation, -privilege separation). This section frames the model they +The implementation docs document the specific mechanisms (nixbld isolation, +privilege separation; see the list at the end). This section frames the model they serve: **what hyperhive defends, what it deliberately doesn't, and where the operator is accepting risk.** It's the reference for "is it safe to give an agent capability X?." @@ -20,7 +20,7 @@ default**. Isolating credentials _from the agent itself_ is therefore **not a goal**: an agent can read its own tokens, its own `/home//.claude`, and run arbitrary commands as root inside its container. (The narrow exception is _cross-tenant_ leakage — for example the unsandboxed-nix-build `0600` token policy -below stops a build's nixbld user reading the agent's own forge token. That hardens +(see [nix builds](../../4-implementation/trust-boundary/nix-builds.md)) stops a build's nixbld user reading the agent's own forge token. That hardens the boundary; it doesn't sandbox the agent from itself.)