Security Model

The Companion Agent is a security control, so its own behavior is conservative by design. This page documents the guarantees it makes and the boundaries it defends.

Design principles

Local enforcement - access decisions are computed on the device; there is no remote bulk-decrypt endpoint and no master key.
Device binding - assertions and leases are tied to a hardware-backed key that cannot be exported.
Origin allowlisting - the loopback broker only serves requests from explicitly trusted origins.
Fail-closed - when trust evidence is missing or stale, the answer is Deny.
Tamper-evident audit - every decision is signed and buffered for sync.

Attack surface & mitigations

Threat	Mitigation
Network access to the broker	Binds to `127.0.0.1` / `::1` only; never `0.0.0.0`.
Malicious local web page	`Origin` allowlist; unlisted origins rejected with `403`.
Stolen credential / token	Device binding - request must come from the enrolled hardware key.
Assertion replay	Audience-bound, short TTL, `jti` replay detection.
Copied Agent files	Device key is non-exportable; identity does not transfer.
Offline lease abuse	Short lease lifetimes; expiry → fail-closed.
Tampered policy or lease	Signatures verified before use; invalid input rejected.
Log tampering	Ed25519-signed events; gaps detectable on sync.

Origin allowlisting

The loopback broker checks the Origin header of every request against a policy-distributed allowlist before doing any work. This prevents arbitrary local web content from driving the Agent.

text

Origin: https://viewer.osdfsystems.com   → allowedOrigin: https://attacker.example          → 403 rejected(missing Origin)                           → 403 rejected

Device binding

Decisions are bound to the device key in the TPM or Secure Enclave. The Agent verifies the key is present, usable, and not revoked on every sensitive request. A request that cannot be bound to the enrolled device fails closed.

Fail-closed enforcement

The Agent denies access whenever it cannot positively establish trust:

expired or missing session,
expired or revoked lease (including offline lease lapse),
absent or unusable device key,
unverifiable policy or lease signature,
untrusted or missing origin.

Signed audit events

Each decision emits a signed event capturing the inputs that produced it. Events are buffered locally when offline and synced on reconnect.

json

{  "event": "evt_4c1…",  "ts": "2026-02-11T17:11:02Z",  "decision": "ALLOW",  "doc_id": "01J9…",  "user": "u_3a9f…",  "device": "tpm:9c2e…",  "lease_id": "lse_8f2…",  "inputs": { "session": "valid", "posture": "ok", "lease": "valid" },  "sig": "ed25519:…"}

The signature makes events tamper-evident, and sequence numbers make dropped or reordered events detectable. Forward events to your SIEM via the audit sink.

Architecture - components and boundaries.
Local APIs - the loopback broker surface.
Threat model - platform-wide adversary analysis.