Version: draft

This document describes the CabinCrew Protocol security model, the trust boundaries, and the required behaviors for orchestrators, engines, gateways, and external integrations. It supplements (but does not replace) the normative specification files.

CabinCrew’s mission is to provide deterministic, auditable, and governable automation in environments where safety and correctness are critical.

CabinCrew is designed to enforce:

Workflows must not execute unless all artifacts match their plan-token.

Given the same inputs and workspace state, execution must produce the same results.

All steps must undergo policy evaluation (OPA, ONNX) before execution.

Every meaningful operation must generate structured, immutable audit events.

Plan-token binding prevents:

• stale approvals
• tampering
• workflow replay with modified artifacts

High-risk operations require explicit human approval.

CabinCrew assumes the following adversaries may exist:

An engine may:

• attempt side effects during flight-plan
• generate harmful artifacts
• corrupt state
• hide malicious behavior in binary payloads

Agents or LLMs may:

• produce unsafe code changes
• attempt privilege escalation
• leak secrets
• hallucinate dangerous operations

Attackers may attempt:

• direct write operations
• executing LLM calls outside gateway
• subverting MCP tools

Includes:

• modified binaries
• tampered artifacts
• manipulated model weights
• compromised dependencies

Such as:

• restarts
• partial writes
• system crashes

CabinCrew defines clear trust boundaries:

It is the root of authority.

They must run inside controlled directories and cannot bypass governance.

Gateways enforce governance but must audit themselves.

Outputs must undergo sandboxed evaluation.

Any tool invocation may be risky.

CabinCrew uses a multilayered defense model:

Prevent Engines from:

• touching system files
• escaping workspace
• modifying artifacts after plan phase

Prevents:

• tampering
• replay attacks
• reusing approvals
• modifying plan outputs before take-off

Controls:

• file write safety
• allowed operations
• model-selection rules
• compliance constraints
• workflow context restrictions

Detects:

• hallucinations
• bias
• unsafe content
• secret leakage
• dangerous patches

Guarantees:

• human oversight
• deterministic binding to plan-token
• non-replayable confirmations

Ensures:

• forensics
• compliance
• non-repudiation
• reproducibility

The MCP Gateway must enforce:

• strict path whitelisting
• no .. traversal
• patch sanitization
• redaction of secrets
• OPA denial for unsafe file operations
• audit logging for all requests

It must block:

• raw shell access
• privileged operations
• filesystem-level escape attempts

LLM Gateway must:

• route unsafe prompts to safer models
• rewrite prompts to reduce risk
• detect unsafe outputs
• require human approval for risky responses
• audit everything

It may NOT:

• store raw prompts unless configured
• bypass model-safety rules
• allow direct LLM access from Engines or Agents

Upon restart, Orchestrator must ensure:

• artifacts hashing matches plan-token
• approvals remain bound to the same plan
• state is resumed in a safe, deterministic order
• no step is replayed unless intended
• no step is skipped

If validation fails → workflow must halt.

Implementers should:

Using:

• signatures
• checksums
• OCI-based distribution

• ONNX model hashes
• signed model releases
• reproducible loading

Use private registries when available.

Secrets must:

• never appear in audit logs
• be redacted in artifacts
• not be exposed through LLM prompts
• be bounded to workflow context only

Audit logs must not contain:

• access tokens
• private keys
• raw credentials

CabinCrew-compliant orchestrators MUST:

• deny execution when uncertain
• require approval for ambiguous situations
• enforce policy deterministically
• never ignore gateway failures
• never allow Engines to bypass governance

CabinCrew-compliant gateways MUST:

• evaluate every request and response
• produce audit events
• enforce path boundaries
• block model-unsafe outputs

CabinCrew’s security model is designed to prevent:

• unauthorized modifications
• unsafe LLM or agent behavior
• tampering with workflows
• misuse of tooling
• unreviewed execution
• loss of audit trail

Through the combination of:

• deterministic Engines
• strong governance
• human approval
• plan-token integrity
• audit logging
• MCP/LLM safety gateways

CabinCrew provides an enterprise-grade security layer for AI-driven automation.