Scanner boundary
- read-only built-in behavior
- explicit authorization and fail-closed private transport
- NetworkBroker capability and destination checks
- spawned plugins with bounded IPC, timeout, exit, and output controls
SECURITY ARCHITECTURE
Boundaries that are visible and testable.
Passive built-ins, explicit authorization, brokered networking, process supervision, authenticated operations, and forensic integrity.
Console boundary
- server-side sessions and HttpOnly cookies
- SameSite=Strict and CSRF validation
- RBAC, rate limiting, security headers, bounded bodies
- safe artifact resolution and generic errors
Evidence and trust
- hash-chained audit
- evidence hashes and lineage
- detached signing and trusted/revoked keys
- request-bound policy simulation
- explicit external delivery
Known limitations
K-Shield v5 is a local-first single-node platform, not a hardened multi-tenant distributed control plane. Python mediation is not a kernel syscall sandbox; arbitrary third-party code remains outside some built-in guarantees.
External WORM storage needs an adapter. HA backends and some operator functions remain incomplete or CLI/service-manager oriented.