Architectural Isolation and Boundary Guarantees

Engineering Document - M&A Confidential

This document details how ABS Core guarantees data and execution segregation in multi-tenant and enterprise environments.

---

1. Cryptographic and Data Boundary

• Tenant Isolation: In the Private Engine infrastructure, each client has a TenantID linked to exclusive encryption keys via Secret Vault JIT. Payloads from one tenant are never processed in the same memory context as another.
• Data-at-rest: Logs in D1 are segregated by partition keys and encrypted locally before writing, ensuring that even unauthorized database access will not expose other clients' data.

2. WASM Kernel: Execution Sandbox

• Isolated Linear Memory: Each policy evaluation occurs within a "WASM Worker" instantiated with its own linear memory.
• Runtime Security: Unlike Docker containers that share the host kernel, the ABS Core WASM binary has physical restrictions for syscalls, preventing any policy from attempting to read host files or scan the client's internal network.

3. Enterprise Isolated Model (VPC)

For clients in the financial and defense sectors:

• Dedicated Dispatcher: The buyer can choose to run the ABS Core engine inside their own VPC (AWS/GCP), using only the Central Control Plane as a signaling layer and keeping 100% of data boundaries under their direct control.

---

Verdict: The architecture meets the segregation requirements demanded by banks and regulated institutions, removing the risk of multi-tenant contamination.