Security model

Scout’s security objective is to prevent a mistaken or compromised operator, Branch, Client, or transport participant from silently expanding authority or applying unvalidated Router control outside its scope.

Layered controls

• mTLS authenticates normal machine connections;
• Branch-local certificate authorities keep issuance local;
• signed Branch authority bounds descendants;
• application-signed messages bind command content, scope, issuer, and life;
• native Zenoh ACLs enforce the data/management boundary;
• the fixed admin and its revocable bearer tokens are evaluated with Branch scope;
• configuration validation, last-good state, health gates, and audit support safe operation and recovery.

Transport arrival is never sufficient authorization for a remote mutation. Every scout-agent accepts only typed, scoped commands from authorized signing keys; it does not execute an arbitrary remote shell command. On a Branch Router host, the router-profile agent is the supervision seam between the local Controller and the singular Router process.

Non-negotiable invariants

1. Private keys and live credentials never enter APIs, logs, fixtures, or the repository.
2. A child or credential cannot exceed parent-assigned scope.
3. Data identities cannot use the reserved management namespace.
4. Remote mutations use signed, scoped envelopes.
5. A candidate is checked before replacing the running configuration.
6. Router-profile agent management remains independent of the managed zenohd.
7. Stale or unavailable state is labelled honestly.

These are implementation invariants, not a security certification. Broader replay, credential-theft, CA-lifecycle, authorization-matrix, supply-chain, backup, and restore qualification remains tracked work.