Compute and read
Pure work and scoped read-only calls can be replayed or cached when freshness, authorization, and subject boundaries allow it.
// security posture
Sensitive infrastructure needs visible boundaries.
Punk sits between applications, models, tools, web context, and consequential actions. Its design keeps execution attributable, tenant-scoped, policy-governed, and reviewable.
Important scope
This page describes product design and review questions. It is not a certification statement, compliance attestation, or guarantee that every control is enabled in every deployment.
// identity boundaries
Every route needs context about who owns the work.
| Boundary | What it scopes | Example |
|---|---|---|
| Tenant | Runs, traces, settings, keys, policies, caches, and reusable workflows | Tenant-scoped storage and authorization |
| Application | Traffic for one logical product or workflow | X-Punk-App |
| Agent | The bot or workflow actor responsible for execution | X-Punk-Agent |
| Subject | The user, account, workspace, or queue safety dimension | X-Punk-Subject in eligible cache keys |
| Credential | Access to model providers and connected systems | Scoped provider configuration or supported tenant BYOK |
| Artifact | A reusable workflow's origin and evidence | Lifecycle, replay/shadow records, policy, rollback |
// action governance
Unknown tools are treated conservatively.
Punk classifies side effects from pure computation through high-impact writes. An undeclared tool defaults to level 3: a user-visible write.
Controlled writes
Reversible, idempotent, or user-visible writes need explicit treatment. Replay and shadow suppress or dry-run effects.
High impact
High-impact actions are expected to remain live and approval-gated by default, subject to tenant policy.
// traces and learning
Optimization does not require a shared raw-data pool.
The trace ledger is append-only so derived patterns, routes, and evidence can be rebuilt. That makes retention and access decisions important.
Default learning posture
- Tenant-local optimization
- No cross-tenant raw-data use by default
- Explicit opt-in for aggregate learning
- Scoped identities in routing and cache decisions
- Secrets excluded from explanations and public collateral
Validate for your deployment
- Storage encryption and operational access
- Retention, export, and deletion behavior
- Redaction, masking, and PII handling
- Credential storage and rotation
- Administrative audit and tamper evidence
Do not infer an implementation-specific control from the architecture. Hosted configuration, customer deployment model, legal terms, and enabled controls must be reviewed together.
// untrusted inputs
Content is data, not runtime instruction.
Tool outputs
Tool responses should be typed and sanitized before reuse. Embedded instructions do not independently authorize actions.
Web + documents
Pages, retrieved text, and documents are untrusted context. Policy checks operate independently of model-generated intent.
Memory influence
Low-trust context should not trigger high-impact side effects without a policy-approved path and any required human decision.
// review packet
Ask these questions for every important route.
Ownership
Which tenant, app, agent, and subject owns the run, trace, cache entry, workflow, credential, and policy?
Actions
Which tools ran, what were their side-effect levels, and were any writes suppressed, blocked, approved, or executed?
Decision
Which route served, which alternatives were rejected, what policy version applied, and why did fallback occur?
Evidence
If optimized, what replay, shadow, mismatch, canary, freshness, and rollback evidence supports the route?
Data lifecycle
Which credentials, retention rules, redaction controls, and access records apply in this deployment?
Review the real deployment, not a badge wall.
Bring your workload, data classes, tools, retention needs, and approval rules. We will map them to the boundaries Punk can enforce and identify what still needs validation.