Where each boundary is, and what crosses it.
Three boundaries: the host, which is trusted and yours; the organisation network, which is separate from other organisations’ networks; and the workspace, which is not trusted. Pick a credential to see where it lives and where it never goes. A member’s own computer, if a platform operator grants it and your organisation turns it on, is a fourth case: no git token or AI key is stored there, but its network and its disk are that computer’s.
Credentials
WorkspaceFront door · inTerminal, VS Code, previewWhat the request reaches, once it is authenticated.
Organisation networkRouted to your workspaceOnly to workspaces in your organisation.
HostFront doorAuthenticates every request before it reaches the container.
OutsideYou, in a browserPassword or SSO session, 24 hours, revocable.
WorkspaceGit socket · outgit pushGitHub credentialGitHub token mounted
Organisation networkPer-workspace unix socketIdentity comes from the socket, not from a token.
HostGit brokerParses the push, applies the gate (off by default) and signs the authorship label.GitHub App key · root-owned
OutsideGitHubReached only through the broker, in every egress mode.Token · about 1 h
WorkspaceModel proxy · outClaude Code and chatPer-workspace model keyProvider key
HostModel proxySwaps the workspace's key for yours. The workspace key is worthless off this host.Anthropic API key
OutsideModel providerReceives your code as context.
WorkspaceEgress proxy · outnpm, pip, curlEverything else that leaves.
Organisation networkDNS filterUnlisted names get REFUSED, and the refusal is audited. Not enforced on a member’s own computer.
HostFirewall, then egress proxyDirect connections dropped. The proxy decides by hostname: observe by default, deny when you switch it. On a member’s own computer, egress is observed, not enforced.
OutsideAllowlisted hostsBy default GitHub (broker only), npm, PyPI, the Anthropic API and Open VSX.
WorkspaceAttach tunnel · offssh sessionBypasses the file-transfer rule. The admin's switch-on names that risk.
Organisation networkPer-workspace attach network
HostWebSocket tunnelThe token is checked on every upgrade.
OutsideDesktop IDEVS Code Remote-SSH, JetBrains Gateway, ssh.Attach token · 12 h
HostThe record · staysAudit chain on host diskIdentity, workspace, policy, git, egress and model events.Authorship key
OutsideOnly when you export itCEF, LEEF, syslog, JSON or CSV. Nothing ships for you.
Pick a credential. The cell where it lives lights; where it never goes is struck.
profile: guarded (default)
The nine layers, on the map
The same nine layers as the security model, placed on the boundary each one holds.
- 01Front doorhost edge · every request in
- 02Workspaceworkspace · non-root, limited
- 03Organisation networkorg network · one per org
- 04Firewallhost · fails closed
- 05Egress proxy and DNS filterhost and org gateway · observe by default
- 06Brokershost · git socket, model proxy
- 07Approvals and profileshost · per member, stricter only
- 08Validation gatehost · off until an admin turns it on
- 09Audithost disk · hash-chained
Where your data lives
Four kinds of data, who can read each, and the only ways they leave.
| Data | Where it lives | Who can read it | What crosses out |
|---|---|---|---|
| Source code | Workspace volume; your git host; a member’s own computer, if your organisation turns that on | The workspace owner; admins per role; on a member’s computer, whoever uses it | git push through the broker; model context through the model proxy |
| Credentials | Host, root-owned or mode 0600 | Host services | Never into the workspace under guarded or strict |
| Audit | Host disk | Operators; organisation auditors (their organisation) | Only when you export it |
| Chat history | Host store | Member; organisation roles | Model provider, as context |
The boundary you hold
Everything above assumes the host is trustworthy. Kodela cannot make it so. The outermost boundary is yours.
- Host hardening. The OS, its patches, and who holds root or sits in the Docker group.
- TLS. Declare it and put a TLS front end in front of the front door. There is no built-in certificate automation.
- Physical security of the machine and its disks, including backups.
Where the boundaries leak
Each of these is on the known gaps list, with what limits it today.
- Open and metered profiles mount the GitHub token in the container. Guarded is the default.
- The per-workspace model key is readable by its developer. It is useless off your host.
- Other model providers. The OpenAI, Codex and Antigravity broker is partial and off, and the in-workspace Antigravity CLI does not use it.
- Desktop IDE attach bypasses file transfer. It is off by default, and switching it on names the risk.
- Host root can read every credential and rewrite the record. Tamper-evident is not tamper-proof.
- Plain HTTP unless you add TLS.
- Members’ computers. Off by default. If a platform operator grants it and your organisation turns it on, egress there is observed, not enforced; DNS filtering is not enforced; the source on its disk is readable by whoever uses it; Docker is not available. Tested end to end only on Windows (Linux laptops up to enrolment; Mac only in a simulation).
- Privileged full Docker. Under
privileged, the firewall and no-credentials guarantees no longer hold for that workspace. Only an operator can set it, and every create is audited.
See every component
The architecture docs walk each component and what it refuses.