Security boundaries
Security starts by naming which component owns each decision. BernOps applies workspace and project authorization, scoped credentials, and bounded workflows; infrastructure operators still own host and workload isolation.
Human requests use authenticated project access. Project automation uses scoped keys. Every worker has a revocable credential bound to one workspace, and dispatch cannot move that worker into another workspace.
The backend validates target URLs and allowed origins before dispatch. The worker repeats DNS, request, redirect, and subresource checks. Private and local targets are rejected by default.
Traces, screenshots, logs, and attachments can contain sensitive application data. Private storage and short-lived access URLs reduce exposure, but content must be scrubbed before capture or upload.
BernOps does not provide or verify execution isolation. Configure containers, virtual machines, network policy, and host permissions for your risk model. Concurrency settings are not an isolation mechanism.
EARLY ACCESS
