Per-User Instances Behind Capability Gateways

Per-User Instances Behind Capability Gateways An architecture diagram generated by Archify. User · Architecture component User Workspace · Durable Object, the kernel · Architecture component · one per user Workspace Durable Object, the kernel one per user Gadget A · Dynamic Worker facet · Sandbox: no network, no ambient credentials · globalOutbound: null Gadget A Dynamic Worker facet globalOutbound: null Agent · writes and runs code · Sandbox: no network, no ambient credentials Agent writes and runs code Gadget B · Dynamic Worker facet · Sandbox: no network, no ambient credentials · globalOutbound: null Gadget B Dynamic Worker facet globalOutbound: null Gatekeeper: GitHub · logs every call · Architecture component Gatekeeper: GitHub logs every call Gatekeeper: Google · holds side effects for approval · Architecture component Gatekeeper: Google holds side effects for approval GitHub API · Architecture component GitHub API Google API · Architecture component Google API explicit binding explicit binding Sandbox: no network, no ambient credentials Legend Backend Security External

Per-user instances

  • • A private instance of every app, not a call into a shared one
  • • Cross-tenant leakage is unrepresentable, not mitigated
  • • Only viable because an isolate costs near zero

Deny by default

  • • globalOutbound: null — no route to the internet
  • • The client iframe runs on an opaque origin with connect-src 'none'
  • • The sandbox is a platform primitive, not a lint rule

Capabilities, not configuration

  • • A human introduces the agent to one specific resource
  • • One chokepoint mints every gatekeeper capability
  • • The dotted edges are the whole design