Security

Security is a foundational principle in OpsSquad. Since agents execute commands on your production infrastructure, we've built multiple layers of protection to keep your systems safe.

Security Philosophy

OpsSquad is built from the ground up to meet the most stringent security and compliance requirements of modern enterprises. We don't just monitor your infrastructure; we protect it generally through four key pillars:

Core Security Features

1. TLS Encrypted Sockets

Lock & Secure Transport

All communications use TLS encrypted sockets to prevent data leaking. Your data remains secure in transit and at rest, ensuring complete confidentiality. whether it's agent command traffic or platform data.

2. Proprietary SLM AI Guardrails

Intelligent Intent Filtering

A proprietary SLM (Small Language Model) AI model classifies and blocks dangerous terminal commands instantly. Unlike simple static whitelists, the system proactively filters intent to prevent unauthorized actions, understanding context better than regex-based rules.

3. Permission-Based Execution

Verified User Control

The system requires explicit user permission for agents to execute non-read-only commands. This human-in-the-loop approach prevents misaligned automated operations. You are always in control of what the agent does on your server.

4. Continuous Security Layering

Defense in Depth

Continuous addition of security layers ensures a safe experience and prevents agent hallucinations, keeping your operational environment stable and predictable. This includes resource limits, timeout constraints, and proactive monitoring of agent behavior.

Audit Logging

Every action is logged:

Logged Events

Event	Details Captured
Command Execution	Command, args, timestamp, user
Approval Decision	Approved/denied, who, when
Connection Events	Connect, disconnect, errors
Configuration Changes	What changed, who, when

Audit Log Format

{
  "timestamp": "2024-01-15T10:30:00Z",
  "event_type": "COMMAND_EXECUTED",
  "agent_id": "agent_abc123",
  "cluster_id": "cluster_xyz789",
  "user_id": "user_def456",
  "command": "ps aux",
  "result": "success",
  "execution_time_ms": 150
}

Log Retention

Logs retained for 90 days (default)
Export available for compliance
Extended retention on enterprise plans

Authentication & Authorization

Agent Authentication

Agents authenticate using:

Agent ID - Identifies the agent
API Key - Secret authentication token
Request IDs - Prevent replay attacks
Timestamps - Prevent stale requests

User Authentication

Users authenticate via:

Email/password
OAuth (Google, GitHub)
SSO (enterprise)

Authorization Model

Role	Capabilities
Owner	Full access, billing
Admin	Manage clusters, agents, users
Member	Use chat, view dashboards
Viewer	Read-only access

Network Security

Agent Connections

Outbound TCP only (agent initiates)
TLS Encrypted Sockets for all traffic
Certificate validation
No inbound ports required

Platform Infrastructure

DDoS protection
WAF (Web Application Firewall)
Rate limiting
IP allowlisting (enterprise)

Permission & Approvals

The Permission-Based Execution system ensures humans control sensitive actions:

When Permission is Required

Non-read-only commands
Commands affecting services
File modifications
Any potentially risky operation classified by the SLM

Approval Workflow

Agent proposes an action
SLM AI Guardrails analyze intent; if safe, it proceeds to user review. Dangerous intents are blocked immediately.
System pauses and notifies user for Permission.
User reviews the exact command.
User grants permission or denies.
Command executes only after explicit verification.

See Approvals for details.