Paracoding is built on one non-negotiable rule: there is no unattended path to root. Your agents can think, plan, and stage any action they like — but the only thing that turns a proposal into a real change on your infrastructure is a human, holding a passkey, in the moment. Here is every layer, honestly.
See the layers ↓There is no side door. Not for an agent, not for a stolen token, not for the platform itself.
Each one is a real GCP control — and each one is here for a reason we can name.
Agents never execute privileged work directly. They write a staged job to a confirm queue; a job only runs after a human approves it. When we built this, the infrastructure agent itself refused to approve its own deploy — "I stage; the human commits." That property is proven live, not aspirational.
Approvals are authorized with WebAuthn / passkeys, bound to your device's biometrics. The first device is enrolled with a one-time setup password that is then permanently disabled; every additional device must be added from an already-trusted one. Destructive commands trigger a second, explicit Face-ID confirmation.
When you approve a job, it executes under your Google identity via a short-lived OAuth token, valid only inside a 12-hour "ops window" you open with a click and end on logout. There is no always-on service account with god powers sitting in the project waiting to be stolen.
The runners and executors that do the day-to-day work are scoped to exactly what they need — typically datastore.user plus read access to a single secret — and nothing more. The scheduler that wakes them can only invoke one service. No component is a project owner; none can redeploy the platform.
Container images ship code and tools only, zero secrets. Credentials are pulled from Google Secret Manager at runtime and injected as needed. The open-source release provisions an empty secret slot; you drop in your own credential. Nothing sensitive is ever baked into a layer that could be pulled and cracked.
The control plane is a proper OAuth 2.1 resource server: authorization-code + PKCE, dynamic client registration, discovery documents, Google-delegated login. Each role's identity is derived from a validated token, server-side — so an agent can't simply claim to be another role. An early version once carried a token in a URL where it could leak; fixing that reframed the entire model.
Every deploy verifies the source against a known SHA before it builds, passes a type-check gate, and is additive — new capability is layered in without rewriting what already works. If a build fails, the previous revision keeps serving. No outages, no "how did prod change?" mysteries.
Security theater is telling you everything is green. We publish a real posture — including the edges we're still hardening — because a threat model you can trust is worth more than one that flatters us.
| Property | Status | What that means |
|---|---|---|
| No unattended path to root | Enforced | Privileged actions require a human passkey commit. Proven live. |
| Server-verified role identity | Enforced | Identity derived from a validated token; roles can't be spoofed. |
| Least-privilege components | Enforced | Runners/schedulers scoped to the job; no owner-level access. |
| Secrets never in images | Enforced | Runtime injection from Secret Manager; bring-your-own-credential. |
| The gate is the whole boundary | By design | Once you approve, the executor can run what you approved as you. That power is why the passkey commit is non-negotiable — review the command before you tap. |
| Rate limiting on the control plane | Operator-set | Bring your own quotas and budget alerts; we ship the guidance, you own the ceilings. |
| Credential leak resilience | Mitigated | Short-lived, revocable identity limits exposure — but rotate promptly if a device is lost. |
Written to survive a real security review — the same threat model ships in the repository so you can audit it yourself.
That's the whole point of Paracoding. Real autonomy for the drafting, planning, and staging. A human on the commit key for anything that touches your cloud. Read the code when it ships, or start with the model.
