Architecture • Security Model

Security Overview

RTQ's security architecture delegates containment to platform isolation tools, computes risk authoritatively, and mandates explicit capability registration. Authorizations are represented as short-lived, single-use, cryptographically-signed tickets.

Alpha Software: RTQ has not undergone an independent security audit. All claims link to automated tests pinned at commit e179d2b.

View Evidence Matrix →

Pipeline Layers

1. Capability Registry

INV-01

Every operation must be explicitly registered before execution. Unregistered capability names return decision: 'denied'.

2. Risk Engine

INV-04

RTQ evaluates risk authoritatively. Caller claimedRisk cannot lower declared risk ratings.

3. Policy Rules

INV-03

Default-deny evaluation. A missing matching rule evaluates to decision: 'deny'.

4. Clarification

Bounded Turns

When a capability requires parameters not provided, RTQ prompts with structured questions rather than guessing.

5. Approval

INV-12

Human or device challenge-response via HMAC-SHA256-signed, single-use authorization tickets.

6. Platform Sandbox

INV-07

Execution containment is delegated to platform security mechanisms (macOS Seatbelt, Linux bubblewrap, Windows AppContainer).

7. Redacted Audit

INV-08

Structured audit events with HMAC integrity. Sensitive environment keys and tokens are stripped.

Tested Core Properties

•Explicit Surface: Only registered capabilities can execute. Unknown capabilities return code: "capability.not_registered" (INV-01).
•Default Deny: A missing policy rule is a denial, never an implicit allow (INV-03).
•Authoritative Risk: Caller claims cannot lower risk in tested authorization paths (INV-04).
•Single-Use Tickets: HMAC-SHA256, bound to exact operation parameters. Second redemption returns ok: false (INV-09).
•Fail-Closed Sandbox Initiation: If the platform sandbox backend cannot be initialized, execution halts.

Code Example

// Register a capability with declared base risk
rtq.registerCapability({
  name: "files.delete",
  version: 1,
  inputSchema: { type: "object", properties: { path: { type: "string" } }, required: ["path"] },
  risk: { base: "high", factors: ["irreversible"] },
  execute: async (ctx, input) => {
    // Executes inside OS sandbox with verified ticket
    await fs.unlink(input.path);
    return { ok: true };
  },
});

View Security Evidence →Threat Model & Limitations →