Trust zones
Management plane
Trusted intrnl services:
- Laravel/Filament control plane
- Identity broker
- MCP authorization layer
- Orchestrator
- PostgreSQL metadata database
- Forgejo
- Artifact registry/object store
- Key management and secrets
- Audit service
Customer application code must never execute here.
Build plane
Assume source code, package manifests, dependencies, build scripts, and post-install scripts are malicious.
The build plane receives only:
- An immutable source revision
- A supported builder image
- Read-only package access
- A short-lived artifact upload credential
- Build-specific metadata
It does not receive:
- Production database access
- Production secrets
- Runtime service credentials
- Control-plane database access
- Cluster administrator credentials
- Credentials belonging to another organization
Runtime plane
Assume deployed application code can be buggy, intentionally malicious, or compromised.
Each application environment executes inside its own OS-level sandbox in v1. workerd remains the application runtime but not the security boundary. Cloudflare’s own workerd documentation explicitly warns that it is not, by itself, a hardened sandbox for potentially malicious code and should be placed inside an appropriate secure sandbox such as a VM. workerd security model
Binding/data services
The database, KV, secret/integration, and egress services are trusted brokers.
An application receives a logical capability such as:
env.DB
env.KV
env.AUTH
env.INTEGRATIONS
It does not receive:
a filesystem path to its SQLite file
a raw Valkey password
a shared database connection string
a control-plane token
a customer network credential
External AI vendors
Claude, ChatGPT, and Codex are external systems.
They are authenticated clients of intrnl, not trusted infrastructure components. Every tool invocation is reauthorized by intrnl regardless of what the model says the user intended.
Future customer network integrations
Enterprise resource planning systems, internal APIs, reporting databases, or private networks sit behind explicit integration boundaries.
No application gets ambient access to the organization’s internal network.