Skip to content
centiceps

Security model

Centiceps begins with structural separation. The management plane, machine-facing core, and consumer request path have distinct identities, connections, and data access.

Trust-zone rules

Section titled “Trust-zone rules”
  • Consumer traffic never enters the control plane.
  • Gateway pods never connect to Postgres.
  • The control plane never pushes configuration directly to gateway pods.
  • Runtime resources are content-addressed and verified before use.
  • A candidate generation never replaces last-known-good until validation and compilation finish.

Management security

Section titled “Management security”

The management API uses authenticated actors, role-based authorization, and audit records. Local bootstrap credentials are a development convenience and must be disabled or replaced in every shared environment.

Runtime identity

Section titled “Runtime identity”

The gateway backend owns consumer registry and token services. Gateway pods cache resolved identity according to configured bounds and fail closed for security-sensitive cold misses.

Built-in policies cover common edge controls including API keys, OAuth2, JWT, HMAC, mTLS, address restrictions, request limits, and threat protection.