Operating limits & precautions — read before you rely on it¶

NaZelo Trust states, in the code and here, exactly what each control proves and where it stops. None of the limits below is a defect; each is a boundary you must know so you neither over-trust a result nor mis-configure a policy. The rule underneath all of them: enforcement is real, but read what it actually observed, not what you hoped it did.

1. Assurance is a ladder — Enforced is not Attested¶

Each assertion carries an assurance_class, DERIVED from facts, never declared:

Class	Means
`imported`	a workload's own self-report — proves nothing on its own
`observed`	the enforcer saw it, but did not enforce it
`enforced`	the enforcer applied the control (the common, honest result)
`attested`	enforced AND proven by an adversarial suite on a hardware-isolated (MicroVM) boundary AND anchored by an external witness

enforced is the ceiling for a bwrap/namespace run. attested needs the MicroVM posture + an external witness (Rekor/TSA/SCITT). If the enforcer acted but its own evidence could not be read, the run seals observation_status: unavailable and is capped BELOW attested — enforcement still happened, its proof is incomplete, and the run says so.

2. TLS without termination sees the host, not the request¶

Under the default SNI mode, the L7 proxy enforces the destination host at the connection, but the request method, size, body schema, fields and data class are inside the encryption and are not seen. Such a decision is sealed with observation_status: unavailable — never presented as if the semantics were enforced. To enforce method/size/schema/fields/data-class over TLS you must run the terminating proxy (a per-run CA you control); otherwise those apply only to cleartext HTTP and to OT protocols.

3. Body checks (schema, fields, data class) see only the read window¶

Rate, schema, field allow-list and data-class rules act on the request body the proxy reads on the first pass. A body whose declared Content-Length exceeds the read window is fail-closed (blocked) rather than passed unchecked — safe, but it means very large bodies are refused, not partially inspected.

4. Data-class detection is deterministic, not semantic — and has two escapes¶

Classification is the DLP approach (deterministic, explainable), by field name and by value:

By name — a field named ssn/card_number/diagnosis is classified. A field named exotically (note, x, field_7) escapes name matching.
By value — a value that IS a card number (Luhn-valid), a JWT/AWS/PEM key, an email or an SSN is caught even in an oddly-named field. It is deliberately conservative (few false positives), so it can miss a value with no standard shape. In particular, critical control values have no universal value shape (a valve setpoint is just a number).

Therefore, for the values that matter most, the real lock is the deterministic pair — a body_schema and an allowed_fields allow-list — with the data class as the semantic net on top, not the sole control. A vertical can add its own value shapes via register_value_matcher, and any deployment overrides the whole catalog via NAZELO_DATA_CLASSES.

5. What leaves the machine is YOUR choice, with a safe default¶

Exports are operational, never evidentiary — the sealed Litatoli chain is the only source of authority, and a collector/SIEM/log being down never authorises an action nor turns a proof into a non-proof. See DISCLOSURE-POLICY.md:

Your own SIEM (--otlp) — you choose the detail (--otlp-disclosure minimal|standard|verbose), safe default minimal.
A public transparency log (Rekor/TSA/SCITT) — commitment only, by design: a public log is permanent and world-readable, so content is never sent (and a hashedrekord is a digest by format anyway).
A registry you control (customer ledger) — the "publish more" path.

No secret or credential VALUE is ever emitted by any export.

6. JAQ is fail-soft; the base policy always holds¶

Adaptive containment (drift → tighten) is best-effort tightening only. If the telemetry, the drift check, or the atomic re-attach errors, the run keeps the signed base BIM in full force — JAQ never widens, and a JAQ failure never fails the run.

7. Cooperative controls state that they are cooperative¶

The agent-action gate and the SDK action token are cooperative (no valid token, no action) — enforced by the runtime that admits the action, not by a kernel. They are labelled as such; they are not a substitute for a network/kernel boundary, they are the layer above it.

For the formal model of what a run proves see EVIDENCE-CONTRACT.md, and for what leaves the machine see DISCLOSURE-POLICY.md.