Security Model

Prismoid treats the model as a planner operating across explicit trust boundaries.

Trust boundaries

untrusted / probabilistic                   trusted / deterministic

model output
    │
    ▼
ProposedAction
    │
    ▼
Policy evaluation
    │
    ▼
Capability adapter argument validation
    │
    ▼
Environment / external system
    │
    ▼
Artifact + observation
    │
    ▼
Verifier

Rules

Model output is data

Never interpolate model-produced strings into a shell command. Shell/process capabilities must model executable + argv separately and enforce allowlists/sandboxing.

Capabilities are authority

A tool schema is not a security boundary. The concrete capability implementation determines what action is possible and must validate the requested scope.

Policies are mandatory middleware

The runtime is the only owner of capability invocation. A model adapter cannot execute actions on its own.

Verification is not authorization

A verifier checks outcome correctness. It does not grant permission to perform an action.

Content addressing is provenance, not authenticity

A BLAKE3 digest proves byte identity, not who produced or approved an artifact. Signing arrives at the package/control-plane layer.

Future untrusted component model

Do not load arbitrary .so/.dylib plugins. Prefer WASI Component Model, isolated processes, containers, or remote workers with explicit capabilities and resource limits.