EVE Core/Docs/Threat Model
Security

Threat Model

What EVE CoreGuard is designed to withstand, and the assumptions it depends on. This is deliberately explicit; a governance layer that will not state its own boundaries should not be trusted.

What a certificate protects against

  • Silent tampering of the decision. The Ed25519 signature covers the request digest, response digest, rule-results digest, verdict, disposition, policy version and charter hash. Changing any bound field breaks verification — proven by tests/test_coreguard_audit_binding.py and the quickstart tamper suite.
  • Fabricated "approvals". A verifier needs only the public key; it cannot be fooled by an application that claims a decision it never obtained, because the signature is over the exact inputs and result.
  • After-the-fact editing. Request/response are bound at decision time; a stale approval cannot authorise a changed action because the action digest would no longer match.

Fail-closed boundaries

The engine blocks rather than proceeds on: missing signing configuration (no silent HMAC downgrade — core/governance/cert_signing.py), runtime-integrity failure (evaluator.py RIC gate, tested by tests/test_coreguard_ric_failclosed.py), malformed decisions, timeouts, unknown signing keys, policy-digest mismatch, and expired decisions (core/governance/fail_closed.py). The sidecar returns HTTP 451 with a signed certificate on veto and severs the connection before the upstream call (interfaces/gateway/forward_proxy.py).

Assumptions & out-of-scope

  • Key custody. A certificate proves it was signed by the holder of a given key. Attributing that key to EVE requires obtaining EVE's public key over a separately trusted channel and pinning its fingerprint out-of-band (the standalone verifiers accept --expected-fingerprint). A compromised signing key can produce valid-looking certificates; key protection (HSM/KMS) is a deployment responsibility.
  • Policy correctness. EVE enforces the policy it is given and binds the result; it does not guarantee the policy encodes the right rule. Garbage policy in, faithfully-signed garbage out.
  • Symmetric (HMAC) mode is not third-party verifiable. Only Ed25519 (default) is independently verifiable with a public key.
  • Independent witnessing is a preview. Until Trust Services ships, a certificate is self-signed by EVE only; a self-signed certificate does not prove a non-EVE party saw the decision. See Limitations.
Part of the EVE AI Core control plane Deterministic AI Governance Control Plane → Policy decisions that return the same result for the same input every time, before execution.