Security & mTLS identity

The agent is designed so that adding it to a server reduces your attack surface rather than adding to it.

A cryptographic identity per agent

Enrollment doesn’t hand the agent a shared secret. Instead:

• The agent generates a private key locally — it never leaves the host.
• It sends only a certificate signing request. Demerzel returns a certificate whose identity (demerzel://tenant/agent) is assigned by the server, not chosen by the agent.
• From then on the agent authenticates with that certificate (mTLS). The enrollment token is single-use and burned.

No inbound surface

The agent is outbound-only. It opens HTTPS connections to Demerzel and listens on nothing. There is no port to firewall, no daemon to exploit for remote access, and no command channel back to your servers: nothing Demerzel sends can make the agent read, run or change anything.

The one thing that flows back: signed fleet decisions

There is a single, narrow exception, and it does nothing unless you turn it on at both ends: Demerzel serves fleet decisions only once an owner or admin enabled them in Settings → Fleet decisions, and a server applies them only once root ran demerzel-warden trust there. While a warden is installed, the agent fetches the bans and unbans Demerzel signed with your organization’s key, and copies them byte for byte, unread, into a directory the warden reads. The agent acts on none of them. The warden — a separate root component with no network access — checks each one’s signature against the key root explicitly trusted with demerzel-warden trust, refuses anything signed with another key or altered on the way, and applies what passes only within its local policy: your allowlists, your caps and the kill switch still win. The only effect a decision can have is on the warden’s own nftables table: an address banned for a limited time, lifted, or protected.

Least privilege

Run the agent as an unprivileged system user that owns only its config directory (see Run the agent as a service). Its stored key and certificate are readable only by that user.

Evidence integrity

Everything the agent reports is recorded as immutable, append-only evidence on the server. Facts are never overwritten, so history is replayable and tampering is detectable.