# Defense-in-Depth Score: Ongrid

**Repo:** https://github.com/ongridio/ongrid · **Commit:** `ce5c620a0af05f79938ea9f74cccff27634db3d0` (v0.17.6) · **Reviewed:** 2026-10-03
**What it is:** Ops AI agent that understands infrastructure, finds root causes and fixes them from Slack/Telegram/Lark/DingTalk
**Category:** Infrastructure & Ops
**Scored configuration:** Self-hosted install via install.sh with root edge agents (ongrid-edge.service) on enrolled hosts; agent/write_enabled left at its default (unset = read-only).
**Agent surface (default):** code execution yes · filesystem write opt-in · network egress yes · external credentials yes · persistent memory yes · untrusted input yes · third party extensions opt-in · sub agents yes · external communication opt-in

## Score: 3.2 / 10.0 (Minimal)

| # | Criterion | S | C | D | B | Raw | Cap | Score | Confidence |
|---|---|---|---|---|---|---|---|---|---|
| C1 | Identity & least privilege | L1 | L1 | L2 | L0 | 0.25 | — | **0.25** | High |
| C2 | Approval gates | L3 | L0 | L2 | L1 | 0.38 | C2-SELFAPPROVE | **0.25** | High |
| C3 | Tool & action scoping | L2 | L2 | L2 | L0 | 0.40 | — | **0.40** | High |
| C4 | Code-execution isolation | L1 | L1 | L1 | L0 | 0.20 | G2 | **0.20** | High |
| C5 | Untrusted input blast radius | L1 | L0 | L1 | L0 | 0.12 | C5-WORSTCASE | **0.12** | High |
| C6 | Memory, context & configuration integrity | L2 | L2 | L1 | L0 | 0.35 | — | **0.35** | High |
| C7 | Third-party extensions | L1 | L1 | L2 | L1 | 0.30 | — | **0.30** | High |
| C8 | Secrets & sensitive-data protection | L2 | L2 | L2 | L1 | 0.45 | — | **0.45** | High |
| C9 | Audit & traceability | L2 | L2 | L2 | L1 | 0.45 | — | **0.45** | High |
| C10 | Limits & kill switch | L2 | L2 | L2 | L1 | 0.45 | — | **0.45** | High |


Ongrid lets a chat agent run commands on every enrolled host through edge agents that run as root. By default the agent is read-only, and an admin-only approval card guards the write tools once writes are enabled. But enforcement of the read-only host shell filter and of the write approval gate are not complete boundaries. Combined with untrusted logs and repos in context, a hijacked session has unattended egress paths.

## Critical gaps
- Every edge agent runs as root, and any non-viewer user or IM message can direct the agent at any enrolled host, so a hijacked agent has fleet-wide root authority. (ASI03, T3; C1) — [deploy/install/edge/ongrid-edge.service:23-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L23-L31); [internal/manager/biz/imbridge/adapter.go:56-60](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/imbridge/adapter.go#L56-L60)
- A hijacked session has unattended egress paths in the default configuration, and its reach to act on hosts is not fully contained. (ASI01, LLM01, T6; C5)

## Criterion details

### C1 Identity & least privilege — 0.25 (high)

Ongrid acts on hosts through edge agents installed on every enrolled machine, and those agents run as root. Agent tools do not check whether the requesting user may act on a given device. Messages from the IM bridge (Slack, Telegram, Lark, DingTalk) all run as one shared service account with no role. The shipped default keeps the agent read-only until an admin enables write actions, though that boundary is not strictly enforced. A hijacked agent can therefore reach root-level authority across the fleet, plus the Kubernetes controller's patch and delete rights.

- **S L1:** All host actions go through the manager-to-edge tunnel to edge agents that run as root on host networking; the Kubernetes chart uses a dedicated ServiceAccount that can patch workloads/nodes and delete pods. — [deploy/install/edge/ongrid-edge.service:23-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L23-L31); [deploy/kubernetes/ongrid-edge/templates/rbac.yaml:140-146](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/kubernetes/ongrid-edge/templates/rbac.yaml#L140-L146) (verified)
  - *To reach the next level:* No per-capability or read-only credential: read and write tools reach the same root edge agent.
- **C L1:** The chat path checks roles (viewer downgrade, admin-only Kubernetes actions), but IM traffic runs as a single blank-role service account, and no tool authorizes per device or per requesting user. — [internal/manager/biz/imbridge/adapter.go:56-60](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/imbridge/adapter.go#L56-L60); [internal/manager/biz/aiops/chatruntime/runtime.go:638](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L638); searched `rg -n -i "CanAccessDevice|device_acl|DeviceACL|allowedDevices"` in `internal/manager/biz/aiops internal/manager/biz/device` → 0 hits (No per-user device authorization in the agent tool layer or device usecase.) (verified)
  - *To reach the next level:* No authorization against the requesting principal on every tool path.
- **D L2:** agent/write_enabled defaults to false, so non-read tools are stripped by default; a single admin setting widens the whole fleet to write with no time bound. — [internal/manager/biz/setting/agent.go:31-37](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/setting/agent.go#L31-L37); [internal/manager/biz/aiops/chatruntime/runtime.go:645-651](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L645-L651) (verified)
  - *To reach the next level:* The read-only default is not tamper-resistant, and elevation is neither time-bounded nor reverting; D is also limited to one level above S.
- **B L0:** A hijacked agent reaches root on every enrolled host plus cluster-wide pod delete and workload/node patch. — [deploy/install/edge/ongrid-edge.service:23-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L23-L31); [deploy/kubernetes/ongrid-edge/templates/rbac.yaml:140-146](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/kubernetes/ongrid-edge/templates/rbac.yaml#L140-L146) (verified)
  - *To reach the next level:* Authority would need to shrink to one system or to non-root, scoped credentials.
- **Cap:** none

### C2 Approval gates — 0.25 (high)

When an admin enables write actions, the classified write tools (cloud_bash, install_skill, restart_service, Kubernetes actions, and host commands whose name matches a short write list) go to a human approval card. Only an admin can approve, and the approved call is exactly what runs. The weak point is host_bash, the most powerful tool: gate coverage for host commands is incomplete, and so is the confirmation step for alert-rule changes. Trusted MCP servers and published workflows run tools without approval.

- **S L3:** The approval broker stores the exact tool args, only an authenticated admin can decide, and a single-use closure runs exactly the approved call; reject is first-class. — [internal/manager/biz/aiops/tools/decorators/human_approval_gate.go:62](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/decorators/human_approval_gate.go#L62); [internal/manager/server/approval/http.go:111](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/server/approval/http.go#L111); [cmd/ongrid/main.go:3715-3716](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L3715-L3716); [internal/manager/biz/aiops/tools/decorators/human_approval_gate.go:95-99](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/decorators/human_approval_gate.go#L95-L99) (verified)
  - *To reach the next level:* No argument-level policy on parsed commands, and the inline card summary is truncated to 500 characters.
- **C L0:** Gate coverage for host_bash is incomplete; trusted MCP tools and workflow tool nodes also skip approval. — [internal/manager/biz/aiops/tools/mcp_basetool.go:134-138](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/mcp_basetool.go#L134-L138); [cmd/ongrid/main.go:5095-5100](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L5095-L5100) (verified)
  - *To reach the next level:* Every consequential host_bash command must pass the gate.
- **D L2:** Write tools are off by default, but the single admin write switch has incomplete gate coverage; no time bound. — [internal/manager/biz/setting/agent.go:31-37](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/setting/agent.go#L31-L37) (verified)
  - *To reach the next level:* Elevated mode is not session- or time-bounded.
- **B L1:** Approved actions are mostly irreversible (host file changes, container cleanup, pod deletes, cloud CLI with injected credentials); there is a 10/min per-(tool,user) rate limit but no checkpoints or dry-runs. — [internal/manager/biz/aiops/tools/decorators/ratelimit.go:22](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/decorators/ratelimit.go#L22); [cmd/ongrid/main.go:2275](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2275) (verified)
  - *To reach the next level:* No rollback/checkpoints for host or cloud actions, and no previews or quantity bounds.
- **Cap:** C2-SELFAPPROVE — The confirmation step for one configuration-change tool does not cover every path.
- **Notes:** The LLM ReviewGate in front of mutating startup-bag tools is not credited as approval (an LLM judge is L0).

### C3 Tool & action scoping — 0.40 (high)

Most built-in tools are narrow, typed, read-only queries (metrics, logs, topology, incidents, Kubernetes snapshots). The generic host_bash tool is checked on the edge against an allowlist of binaries with subcommand rules, absolute-path checks against a few data directories, and a deny-all network list. That filter is not a complete boundary. MCP tool arguments are passed through unvalidated.

- **S L2:** Typed schemas plus an edge allowlist with parsed argv, subcommand matchers and symlink-resolving absolute-path checks; however the filter is not a complete boundary. (verified)
  - *To reach the next level:* Integrity-protect security-relevant configuration on every path.
- **C L2:** Edge validation covers host_bash and host_files tools; MCP tools forward model args verbatim. — [internal/manager/biz/aiops/tools/mcp_basetool.go:134-138](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/mcp_basetool.go#L134-L138) (verified)
  - *To reach the next level:* Extension (MCP) tools are not wrapped by a shared validation layer.
- **D L2:** The default exposes only Class=read tools, but that set still includes host_bash, a general command front-end whose read-only filter is not a complete boundary. — [internal/manager/biz/aiops/chatruntime/runtime.go:645-651](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L645-L651); [internal/manager/biz/aiops/tools/bash_basetool.go:224](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/bash_basetool.go#L224) (verified)
  - *To reach the next level:* The default set should exclude general command execution or make it verifiably read-only; no per-task tool allowlist for the coordinator.
- **B L0:** A misused host_bash reaches any enrolled host as root, and network-device and Kubernetes tools reach production infrastructure. — [deploy/install/edge/ongrid-edge.service:23-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L23-L31); [internal/edgeagent/bash/handlers.go:136-142](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/edgeagent/bash/handlers.go#L136-L142) (verified)
  - *To reach the next level:* Tools would need to be scoped to a project and quantity-bounded.
- **Cap:** none

### C4 Code-execution isolation — 0.20 (high)

Host commands requested by the model run inside the root edge-agent service on each target machine. The edge filters them (an allowlisted binary executed directly, without a shell), and systemd makes most of the filesystem read-only. But there is no separate sandbox: no dedicated user, no container, no seccomp, and the network is open. The filter is not a complete boundary, and gate coverage is incomplete when writes are enabled. The manager-side cloud_bash (approval-gated) runs in a shell runner labelled 'IsolationNone' in its own code.

- **S L1:** Isolation is command filtering inside the root agent's own systemd profile (ProtectSystem=strict, NoNewPrivileges); cloud_bash uses an in-process shell runner declared IsolationNone. — [internal/edgeagent/cmdpolicy/sandbox.go:275](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/edgeagent/cmdpolicy/sandbox.go#L275); [deploy/install/edge/ongrid-edge.service:27-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L27-L31); [internal/pkg/runner/shell.go:23](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/pkg/runner/shell.go#L23) (verified)
  - *To reach the next level:* No OS-level separation per command (dedicated low-privilege user, hardened container, or seccomp profile).
- **C L1:** Only the host_bash read path is filtered; approved and write-gate host commands run in a raw shell, and cloud_bash/skills run unsandboxed on the manager. — [internal/edgeagent/bash/handlers.go:136-142](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/edgeagent/bash/handlers.go#L136-L142); [cmd/ongrid/main.go:2275](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2275) (verified)
  - *To reach the next level:* Every model-reachable execution path would need to go through the same boundary.
- **D L1:** The filter is on by default, but it is not a complete boundary. (verified)
  - *To reach the next level:* Disabling the boundary should need an explicit per-call human approval.
- **B L0:** A command that gets past the filter runs as root on the host network of every enrolled machine, with the edge's tunnel credentials in reach. — [deploy/install/edge/ongrid-edge.service:23-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L23-L31); [deploy/install/edge/ongrid-edge.service:27-31](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/deploy/install/edge/ongrid-edge.service#L27-L31) (verified)
  - *To reach the next level:* Execution would need a non-root, network-restricted, workspace-only environment.
- **Cap:** G2 — The edge command filter is not a complete boundary.

### C5 Untrusted input blast radius — 0.12 (high)

The agent reads plenty of content its operator didn't write: application and Kubernetes logs, traces, synced git repositories, knowledge documents, MCP results, IM messages and web search results. All of it enters the conversation as ordinary tool output, with no provenance tracking. The only defence is a prompt-level hint on one tool. In the default read-only configuration, a hijacked agent can still read sensitive host data as root. A hijacked session has unattended egress paths. Gaps in the shell filter widen this further.

- **S L1:** No structural limit tied to untrusted input; the write gate and approval cards apply globally rather than after untrusted reads, and one tool description asks the model to treat trace data as untrusted. — [internal/manager/biz/aiops/tools/query_traceql.go:23](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/query_traceql.go#L23); [internal/manager/biz/aiops/chatruntime/runtime.go:645-651](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L645-L651) (verified)
  - *To reach the next level:* Once untrusted content is read, every egress and state-changing tool would need to be disabled or forced through approval.
- **C L0:** Tool results from logs, repos, MCP and IM enter context with the same standing as the operator's instructions. — searched `rg -n -i "untrusted"` in `internal/manager/biz/aiops/graph internal/manager/biz/aiops/chatruntime internal/manager/biz/aiops/tools/decorators` → 1 hits (Single hit is a code comment about MCP tool classes, not a provenance control.) (verified)
  - *To reach the next level:* Untrusted sources would need to be distinguished at least for the main ingestion paths.
- **D L1:** The read-only default is on, but it is not strictly enforced. — [internal/manager/biz/setting/agent.go:31-37](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/setting/agent.go#L31-L37) (verified)
  - *To reach the next level:* Nothing the agent reads should be able to defeat the default.
- **B L0:** Unattended: sensitive host data is readable as root, a hijacked session has unattended egress paths, and further state-changing reach exists. (verified)
  - *To reach the next level:* Exfiltration and irreversible actions would both need a human in the loop.
- **Cap:** C5-WORSTCASE — Worst case (B L0): a hijacked agent can leak data and take irreversible actions unattended.

### C6 Memory, context & configuration integrity — 0.35 (high)

The agent has no free-form memory tool. The ways it can persist things are installing a skill, whose instructions are later injected into the system prompt for everyone (gated by human approval), creating alert rules, a per-session cloud_bash workspace, and hosted pages. The knowledge base is curated by operators. Installed skills load silently into future sessions for all users, with no expiry, review or rollback.

- **S L2:** Persistent instruction sources (installed skills) require a human-approved install; once installed, their text is silently composed into the system prompt. — [internal/manager/biz/aiops/chatruntime/runtime.go:605](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L605); [internal/manager/biz/aiops/chatruntime/runtime.go:704](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L704) (verified)
  - *To reach the next level:* No expiry, validation or versioned rollback for persisted instructions.
- **C L2:** Skill installs go through approval; alert-rule creation is not fully covered by confirmation; the knowledge base has no agent write path. (verified)
  - *To reach the next level:* Not every persistence path is controlled.
- **D L1:** Installed skills and other persisted state are global to the deployment, not per user or session. — [cmd/ongrid/main.go:2333](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2333) (verified)
  - *To reach the next level:* Per-user/session namespaces for persisted agent state.
- **B L0:** A poisoned installed skill persists across sessions and users and can steer tool use. — [internal/manager/biz/aiops/chatruntime/runtime.go:704](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/runtime.go#L704) (verified)
  - *To reach the next level:* Persisted instructions should be session-scoped or easily reviewed and purged.
- **Cap:** none

### C7 Third-party extensions — 0.30 (high)

Nothing third-party is enabled by default. Skills are installed from a git or tarball URL that the user supplies, after an approval card, and MCP servers are registered by admins over HTTP only. Signature checks apply only to the official registry, git refs are not pinned, MCP tool lists are fetched again on every boot without re-approval, and tools from 'trusted' servers run without approval. Skill binaries run through cloud_bash on the manager as the same OS user, with a scrubbed environment.

- **S L1:** Sources are user-chosen; git/local installs skip signature checks and refs are optional. — [internal/manager/biz/marketplace/usecase.go:56-60](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/marketplace/usecase.go#L56-L60) (verified)
  - *To reach the next level:* Versions would need to be pinned for every extension source.
- **C L1:** Only official-registry packs are signature-checked; MCP servers and git skills are not verified. — [internal/manager/biz/mcp/usecase.go:207](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/mcp/usecase.go#L207); [internal/manager/biz/aiops/tools/mcp_basetool.go:134-138](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/mcp_basetool.go#L134-L138) (verified)
  - *To reach the next level:* Verification across extension types (MCP, git/tarball skills).
- **D L2:** Nothing third-party is enabled by default; adding a skill requires an approved install showing the source URL, and MCP servers are admin-registered. — [cmd/ongrid/main.go:2333](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2333) (verified)
  - *To reach the next level:* The install prompt does not show the exact code/commands and permissions that will run.
- **B L1:** Skill binaries run through the manager's IsolationNone shell runner as the manager's OS user; env is scrubbed but the filesystem and same-user process state are shared. — [internal/pkg/runner/shell.go:23](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/pkg/runner/shell.go#L23); [cmd/ongrid/main.go:2275](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2275) (verified)
  - *To reach the next level:* Per-extension sandboxing with scoped credentials.
- **Cap:** none

### C8 Secrets & sensitive-data protection — 0.45 (high)

Stored credentials are kept in a vault encrypted with AES-256-GCM. The model sees only credential names, and the values are injected as environment variables at execution time. The command runners on both the manager and the edge build a minimal environment instead of inheriting the parent's. There is no telemetry SDK, and Kubernetes event text is redacted. However, tool output, including cloud_bash output, goes back to the model without secret scanning. Vault key management is not locked down. The vault holds long-lived cloud keys.

- **S L2:** Encrypted vault with opaque credential names in model context and env-scrubbed runners; redaction exists only for Kubernetes events. — [internal/pkg/secretbox/secretbox.go:2](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/pkg/secretbox/secretbox.go#L2); [internal/pkg/runner/shell.go:66-69](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/pkg/runner/shell.go#L66-L69); [internal/manager/biz/aiops/tools/query_k8s_snapshot.go:742](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/query_k8s_snapshot.go#L742) (verified)
  - *To reach the next level:* No redaction or secret scanning on model-bound tool output across major paths.
- **C L2:** Subprocess environments and stored credentials are protected; model-bound tool output and logs are not generally redacted. — [internal/edgeagent/cmdpolicy/sandbox.go:275-280](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/edgeagent/cmdpolicy/sandbox.go#L275-L280) (verified)
  - *To reach the next level:* Model-bound messages and logs are not covered.
- **D L2:** No telemetry SDK; logging defaults reasonable; vault key management is not locked down. — searched `rg -n -i -w "sentry|posthog|mixpanel|amplitude"` in `internal cmd web/src` → 0 hits (No third-party telemetry SDK.) (verified)
  - *To reach the next level:* No always-on redaction.
- **B L1:** The vault stores long-lived cloud credentials injected into cloud_bash; edges hold long-lived tunnel credentials. — [cmd/ongrid/main.go:2275](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L2275) (verified)
  - *To reach the next level:* Credentials are not scoped or short-lived.
- **Cap:** none

### C9 Audit & traceability — 0.45 (high)

Every tool call in the chat graph is written to a database table with its arguments and status. Approvals record which admin decided, LLM-review decisions are logged separately, and worker sessions link to their parent session. The records live in the manager database, are written on a best-effort basis (failures are logged and the action goes ahead), and are not tamper-evident. IM-originated actions are attributed to a shared service account. On the edge, ordinary command execution is logged only at debug level.

- **S L2:** Structured per-call rows with args and status, approver ids, and parent/child session links. — [internal/manager/biz/approval/usecase.go:114](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/approval/usecase.go#L114); [internal/manager/biz/imbridge/adapter.go:56-60](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/imbridge/adapter.go#L56-L60) (verified)
  - *To reach the next level:* No reliable requesting-principal attribution on the IM path; no tamper-evident storage.
- **C L2:** Graph tool calls (including MCP tools) and approvals are recorded; workflow tool nodes and edge-side execution are not clearly covered. — [internal/edgeagent/bash/handlers.go:131](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/edgeagent/bash/handlers.go#L131) (verified)
  - *To reach the next level:* Not every path is verified as recorded (workflows, edge-side debug-only logging).
- **D L2:** On by default in the manager DB outside any agent workspace; the manager process could alter it. — [internal/manager/biz/aiops/graph/callbacks/persistence.go:350-355](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/graph/callbacks/persistence.go#L350-L355) (verified)
  - *To reach the next level:* Not written by a component the agent can't influence.
- **B L1:** Insert failures are recorded internally and the tool still runs. — [internal/manager/biz/aiops/graph/callbacks/persistence.go:350-355](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/graph/callbacks/persistence.go#L350-L355) (verified)
  - *To reach the next level:* Errors are not surfaced to the operator and actions are not blocked on record failure.
- **Cap:** none

### C10 Limits & kill switch — 0.45 (high)

The ReAct loop is capped at 12 iterations by default (specialist workers 15 to 40). Tools time out after 15 seconds by default. Each tool can be called at most 10 times per turn, side-effecting tools are rate-limited to 10 per minute per user, and LLM requests time out after 120 seconds. There is no token or cost cap. A stop endpoint cancels the session's context, but background workers run from a detached context, and spawned workers get their own turn budgets.

- **S L2:** Iteration cap, per-tool timeout, per-tool call cap and rate limits enforced in code; no token/cost cap. — [internal/manager/biz/aiops/graph/types.go:173-178](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/graph/types.go#L173-L178); [internal/manager/biz/aiops/graph/tool_adapter.go:110](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/graph/tool_adapter.go#L110); [internal/manager/biz/aiops/tools/decorators/ratelimit.go:22](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/tools/decorators/ratelimit.go#L22); searched `rg -n -i "token_budget|tokenbudget|max_cost|costlimit|cost_limit|MaxTokens"` in `internal/manager/biz/aiops/graph internal/manager/biz/aiops/chatruntime` → 0 hits (No token or cost budget in the agent loop.) (verified)
  - *To reach the next level:* No token or cost ceiling.
- **C L2:** Top loop plus tool timeouts; workers have separate MaxTurns rather than sharing the parent budget. — [internal/manager/biz/aiops/chatruntime/worker.go:344-349](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/worker.go#L344-L349) (verified)
  - *To reach the next level:* Sub-agents and background tasks do not count against the same budget.
- **D L2:** Sensible defaults, operator-configurable; delegation starts fresh worker budgets. — [cmd/ongrid/main.go:3977](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/cmd/ongrid/main.go#L3977) (verified)
  - *To reach the next level:* The model can extend its effective budget by delegating.
- **B L1:** StopSession cancels the request context, but background workers derive from context.Background and keep running. — [internal/manager/service/aiops/service.go:558](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/service/aiops/service.go#L558); [internal/manager/biz/aiops/chatruntime/worker.go:344-349](https://github.com/ongridio/ongrid/blob/ce5c620a0af05f79938ea9f74cccff27634db3d0/internal/manager/biz/aiops/chatruntime/worker.go#L344-L349) (verified)
  - *To reach the next level:* Stopping should cancel background workers and in-flight calls.
- **Cap:** none

## Rule-of-Two check
[A] untrusted input: Logs, k8s logs, traces, synced git repos and MCP results via tools (internal/manager/biz/aiops/tools/registry_basetool.go:72) · [B] sensitive data/systems: Root-level host reads through host_bash on every edge (deploy/install/edge/ongrid-edge.service:23) · [C] state change / egress: Unattended egress paths and host commands (internal/edgeagent/bash/handlers.go:136) · Same default session? Yes

## Highest-impact improvements
1. Harden the edge read-only command filter. — C3 S L2→L3, +0.075 before caps (Playbook 3 step 1)
2. With writes enabled, route every consequential host_bash command through the approval card. — C2 C L0→L3, +0.225 before caps (Playbook 5)
3. Run edge command execution as a dedicated unprivileged user in a separate sandbox with network off by default. — C4 S L1→L3, +0.150 before caps (Playbook 3 step 2)
4. Close unattended egress channels in the chat UI and hosted pages. — C5 B L0→L1, +0.050 before caps (Playbook 1)
5. Add per-user device authorization and per-IM-user identity binding to every tool call. — C1 C L1→L3, +0.150 before caps (Playbook 4)

## Re-audit log
- No changes.

## Limitations
- Static source review of the pinned commit only; nothing was executed, installed, or probed.
- One edge-filter finding relies on inferred behaviour, not execution.
- Scored the systemd host-edge install; the Kubernetes edge chart, workflow engine and legacy agent kernel were reviewed only partially.
- The web UI was reviewed only for the chat markdown renderer; no reviewer-injection text was found in the repo.