# The security model

What Straza enforces and where, what it trusts, and which actions it does not see.

In short: Straza decides the actions that reach its hook, its MCP gateway or `straza exec`, and it does not see any other action. The gateway is a security boundary, because the decision and the server's credential stay with strazad. A hook installed for the user, on a machine the agent controls, is advisory.


Strazaenforcesadecisiononeachactionthatreachesit.Whetheranagentcanbypassthatdecisiondependsonwhereitismade.[Thesecuritymodelindepth](https://docs.straza.ai/security/security-model/index.md)explainsthemechanismbehindeachrowbelow,and[Knownlimits](https://docs.straza.ai/security/known-limits/index.md)listseveryriskStrazaleaveswithyou.|Question|Answer||---|---||WhatStrazaenforces|Eachtoolcallthatreachesitisallowed,deniedor[heldforaperson](https://docs.straza.ai/concepts/approvals-model/index.md),againstsigned[policy](https://docs.straza.ai/concepts/policy-model/index.md).Everydecisionisrecordedforthe[hashchain](https://docs.straza.ai/concepts/evidence/index.md).||Whereitisasecurityboundary|Atthe[gateway](https://docs.straza.ai/concepts/mcp-apps-and-the-gateway/index.md),foraservertheagentcannotcalldirectly.Insidethesandboximage,where`strazaexec`istheonlywaytorunaprogram.||Whereitisadvisory|Ahookinstalledfortheuser,and`strazaexec`onanopenmachine.Anagentthatcanrunanythingtherecangoaroundeither.||Whatittrusts|YourIGA,oranadminonstandalone,onwhoholdswhich[role](https://docs.straza.ai/concepts/roles-and-access/index.md).Theoperatingsystemofamanagedinstall.Thetransporttostrazad.Theserversyouregister.||Whatisoutsideitsview|Anactionthatreachesnoneofitsenforcementpoints,whatamodelcomputesinsideitsownprocess,modeltraffic,androotonthemachine.||Themainlimitonamanagedfleet|ClaudeCodereadsonlyitshighestmanagedsource,soadevicemanagementprofile,server-managedsettingsoraregistrypolicywithoutStraza'shooksmakesitskipthem.|WhatStrazadefendsagainst:Anagentrunswiththeshell,thefilesandthecredentialsofthepersonortheworkloadbehindit,andamodelcanbepersuadedtousethem.Theattacksthatfollowfromthisareapromptthatturnsintoadestructivecommand,asessiontokenstolenfromalaptop,apolicyswappedonitswaytothemachine,ahookeditedoutoftheharness,anAPIkeyreadoutoftheagent'senvironment,andalogchangedafterthefact.Policycandenydestructivecommands,limitwhichtoolsasessionreaches,oraskapersonfirst,andthegatewayenforcestheratelimitsyouset.Sessiontokensarevalidfor300secondsandcanberevoked,andasessionendsatitsmaximumlifetime,12hoursbydefault.ThesystemserviceonLinux,macOSandWindowskeepseachmachine'skeyunderitsownOSaccount,sotheperson'sownfilesholdnoStrazacredentialandasessiontokencopiedfromtheserviceworksnowhereelse.Aservicestartedwith`STRAZA_HOME`keepsthekeyintheperson'sownfiles,whichstandaloneacceptsandenterpriserefusesbydefault.strazactlkeepsnosign-inandrunsonanadminAPItokenthatapersonmints,abearersecretthatwhoeverholdsitcanuseuntilitexpiresorisrevoked.Noadmincredentialsitsonamachineunlesssomeoneputsatokenthere,as[Credentialsandsessions](https://docs.straza.ai/security/credentials-and-sessions/index.md)explains.Clientscheckeachpolicysnapshotagainstkeyspinnedwhenthemachineenrolled,andneverenforceonethatfailsthecheck.`strazaservice`alsomeasuresitsownbinaryand,onamanagedinstall,theroot-ownedfiles,sostrazadcancomparethemwithitsregistrywhenasessionstarts.Thegatewayaddsstoredcredentialswithoutreturningthemtotheagent.Storedcredentialsaresealedatrest,andtheauditchaincanbecheckedfortampering.##WhateachenforcementpointisworthAhookinstalledfortheuserisadvisory,becauseanagentthatcanrunanythingonitsmachinecanbypassit.Amanagedinstallkeepsthehookinroot-ownedfileswhosehashesstrazadcheckswhenasessionstarts,andbydefaulttheenterpriseprofilestartssessionsonlyfromsuchaninstall.Thegatewayisasecurityboundaryforaservertheagentcannotcalldirectly,becausethedecision,thesession'stoollistandtheserver's[credential](https://docs.straza.ai/concepts/credentials/index.md)staywithstrazad.Aserverthatapersonaddstotheirownharnessneverreachesthegateway,soregistereveryserverthatholdsacredentialinStraza.`strazaexec`decideseachcommanditisgivenandnoneoftheprogramsthatcommandstarts.Onanopenmachineitisalsoadvisory.Insidethedocumentedsandboximageitistheonlywaytorunaprogram,withthegapsdescribedbelow.Thesandboximage,thePythonkitandtheconsole:Insidethesandboximagethepathholdsonlytheshim,thewrappershellandtheagent'sinterpreter.Everyotherfilelosesitsexecutebitatbuildtime.Afilethatkeepsitfailsthebuild.Withthedocumentedruntimeflags,therootfilesystemisread-only,everywritablemountisnoexec,allcapabilitiesaredroppedandnoprocesscangainprivileges.Computationinsidetheinterpreterstaysungoverned,becausetheinterpreteristheagent.Everybinaryontheimage'sallowlistcanstillrunwithoutadecision,soaruleonatool'sargumentsisenforcedattheboundaryonlyforatoolthatisabsentfromtheimage.Atoolwhoseargumentsmustbeenforcedbelongsbehindthegateway.Networkisolationdependsonhowyouruntheimage.Theshippedcomposefileleavesitsnetworkroutable,sothatastrazadonthehostcanbereached.Setting`internal:true`onthatnetwork,withonlystrazadattached,letstheagentreachonlystrazad.ThegatewayseesonlyMCPcalls.Adeploymentwiththegatewayalonethereforeleaveslocalcommandsungoverned.ThePythonkitusesthehook'sdecisionpathandsharesitslimit.Itgovernsthetoolcallsthataframeworkroutesthroughitandnotthecomputationinsidetheprocess.Theconsoleandtheself-servicepagecanstartasessionbelowtheattestationminimum,soanadmincanalwayssignin.SuchasessionstillcannotcallMCPtools,becausethegatewaycheckstheminimumagainfromthetokenoneverycall.strazactlneedsnosessionatall,becauseitrunsonanadminAPItoken.[Hooklessprocesses](https://docs.straza.ai/guides/govern-an-agent/hookless-processes/index.md)showshowtorunthesandboximage.##ClaudeCodeonamanagedfleetAmanagedinstallwritesStraza'shooksintoClaudeCode'smanagedsettingsfile,andbydefaultClaudeCodeusesonlythehighestofitsmanagedsources.Server-managedsettings,aClaudeCodeprofilefromadevicemanagementtoolsuchasIntuneorJamfPro,andaregistrypolicyonWindowsallrankabovethatfile.OnamachinethatgetsanyofthemwithoutStraza'shooks,ClaudeCodeskipsthehookswithnowarning.[Knownlimits](https://docs.straza.ai/security/known-limits/index.md)listswhatreducesthisrisk,intherow"ClaudeCodeskipsStraza'shooksunderahighermanagedsource".##WhatStrazatrustsStrazareliesonthesewithoutcheckingthem:-YourIGA,oranadminonstandalone,isrightaboutwhoholdswhichrole.Awrongroleassignmentleadstoawrongdecision.-Theoperatingsystemkeepsamanagedinstall'sroot-ownedfilessafe.Anagentwithsudooradministratorrightsthereisoutsidethethreatmodel.-Aclientreportsitsinstallandthecustodyofitskeytruthfully.strazadchecksthereportandcannotseewhichprogramsentit.-Thetransporttostrazadissound.EnterprisewarnswhenitservesplainHTTP,andnosettingskipscertificatechecks.-Asession'sclaimtocomefromthesandboximageistrusted,becausestrazadcannotcheckityet.-Anoperatorwhoregistersaserveristrustedwithitsmanifest.Aserverwhoserolescoveronlysomeofits[objects](https://docs.straza.ai/concepts/objects/index.md)keepsthreepromisesthatStrazacannotcheck.##WhatStrazadoesnottrytodo-AninterpretercancomputeanythinginsideitsownprocesswithoutadecisionfromStraza.-Ascriptanagentwritesandthenrunsisdecidedonlyastheinterpretercallthatstartsit,whicharulecandenyorsendtotheclassifier.-Rootonamachinecontrolseveryprocessonit,includingthehook.-StrazadoesnotreplaceyourIGA.-UsingStrazadoesnotcertifycompliance.Itproducesevidenceyoucanmaptoacontrol,andyouassesswhetherthatmeetsaregulation.##HowStrazamakesdecisionsEverydecisionStrazamakesisadeterministicpolicyevaluation,andnoAImodeltakespartinadecision.Theclassifycheckisaheuristicwithnomodel,nonetworkandnostate.Theauditsentinel,offbydefault,runsfixedrulesovertherecordafterthefact,forpatternssuchasawrittenfilethatisthenrun,andblocksnothing.Strazadoesnotproxymodeltraffic,becauseaproxytherewouldseepromptsandmissthetoolcallsthatpolicydecides.Next:[IdentityandyourIGA](https://docs.straza.ai/evaluate/identity-and-your-iga/index.md)