Autonomous write access is a security decision before it is a product feature.
Odonat asks for the right to change your production environment. That only makes sense if the blast radius is bounded by architecture rather than by good intentions. This is how it is bounded.
Runs inside your VPC
The agent is a Helm release in a dedicated odonat-system namespace on your own EKS, GKE, or AKS cluster. It requires zero inbound ports from the public internet. Telemetry arrives by outbound long-polling or the in-cluster event bus. Pods run readOnlyRootFilesystem and runAsNonRoot.
Prompts are scrubbed before they leave
All egress to foundation models passes through a local Envoy sidecar performing two-pass redaction: regex matching for known credential shapes (AWS keys, JWTs, connection strings) and entropy analysis for high-randomness secrets. If redaction fails, the request is dropped rather than sent.
Destructive actions are refused, not discouraged
The execution engine carries a compiled, immutable allowlist. git_revert and scale_replica pass. DROP, DELETE, TRUNCATE, chmod 777, delete_namespace, and force push raise an uncatchable exception and halt execution. This is a hardcoded barrier in Go, not a model instruction.
Confidence gating, then a human
Autonomous execution requires a causal-confidence score of 85% or higher. Anything below that threshold is formatted as an RCA and posted to your Slack channel for one-click approval. The default on uncertainty is to ask, not to act.
Least-privilege, short-lived credentials
Cloud API access uses OIDC tokens valid for a maximum of 15 minutes. The GitHub/GitLab app can read contents and checks and write pull requests, never force push. The Kubernetes ServiceAccount can read workloads and patch deployments for scale only. Administrative write to your cloud provider is denied outright.
Your audit trail, in your SIEM
Every action Odonat requests is signed with an internal key and streamed to Splunk or Datadog as it happens. The compliance record lives in systems you control, so it survives us and can be reconciled independently.
Exactly what Odonat can touch.
Scoped so that a fully compromised agent still cannot destroy infrastructure or exfiltrate credentials.
How the safety plane is proven, not asserted.
- The barrier is the most tested code we ownThe AST parser and the circuit-breaker allowlist are the only things standing between a model and your database, so they carry the strictest coverage bar in the codebase. A gap there is not a bug, it is an incident. We will show you the coverage report and the allowlist source in a technical review.
- Replay against known-cause incidentsEvery release is scored on a fixture set of incidents whose true root cause is already known, so causal accuracy is measured rather than asserted. The set starts from the four injected fault scenarios below and grows with each customer that opts to contribute anonymised cases.
- End-to-end chaos verificationAn injected fault in a staging cluster must produce detection, triangulation, a revert PR, and a Slack notification within 30 seconds, measured end to end rather than per stage.
Certification status. Odonat holds no third-party security certification today, and we will not imply one. What we can show you instead is the mechanism: the Helm chart, the egress proxy’s redaction rules, the compiled action allowlist, and the RBAC scopes above, all reviewable before you grant a single credential. Ask us for the control matrix and we will walk your team through it line by line.