Every boundary, and exactly what crosses it.
Odonat asks for write access to your production environment. That is only reasonable if you can see where the process runs, what it is permitted to call, and what stops it when it is wrong. Everything on this page is taken from the Helm chart you install, not written for the website.
One namespace, two containers, zero inbound ports.
Everything Odonat installs lives inside the innermost box. Nothing outside your VPC can open a connection to it.
Six crossings. Two of them carry nothing.
This is the complete list. If a reviewer finds a seventh, that is a bug and we want to hear about it at security@odonat.ai.
What the ClusterRole does not contain.
A permission list is easy to read charitably. The useful question is what is missing, because that is what a fully compromised agent still cannot do. These verbs appear nowhere in the chart.
Pod hardening
runAsNonRoot: truereadOnlyRootFilesystem: trueallowPrivilegeEscalation: falsecapabilities.drop: ["ALL"]seccompProfile: RuntimeDefaultThese are set in the Deployment template, not exposed as values. There is no override that turns them off.
Four stages, and what bounds each one.
Each stage degrades toward doing nothing. The interesting column is the third.
A pull request is replayed against real production traffic in a Shadow Replay. Latency regressions, malformed config and hardcoded secrets surface here, before the merge button does anything.
Bounded by Fails open. If Odonat cannot report, CI proceeds exactly as it did before you installed it. A reliability tool that can block your deploys is a new source of outages.
What survives the gate ships into a Sentinel Cell: 1% of production traffic, observed for six minutes. Correctness and capacity faults that only appear under real load surface here.
Bounded by Traffic is shaped through your existing Istio or App Mesh, not replaced by ours. If the agent dies mid-rollout your orchestrator carries on.
Datadog, PagerDuty and Splunk alerts normalise into one IncidentEvent shape. The causal engine correlates them against recent deploys and config changes and returns a ranked hypothesis with a confidence score.
Bounded by Reasoning is the only part with a model in it. Ingestion, the deterministic gates and the safety plane are ordinary services, so they keep running when the model provider does not.
Above 85% confidence the executor runs an action from a compiled allowlist: git_revert or scale_replica. Below it, the finding is written up and routed to a human with a one-click approve.
Bounded by The allowlist is compiled into the binary, not prompted. Drops, deletes, truncates, namespace deletions and force pushes raise an exception the calling code cannot catch. Every remediation carries a hard 60-second timeout.
The chart is plain YAML, short enough to read in one sitting, and your platform team should read it rather than take our word for any of the above. What it renders, and the values you actually override, are on the deployment page.