Credentials: there is no shared secret to broker

Authorisation between your network and this service is two keypairs, each side holding only the other's public half. Nothing secret crosses the boundary in either direction, so there is no secret in flight to intercept and none at rest to leak.

Runtime specs declare secrets by name, never by value — MODEL_API_KEY, not the key. A snapshot excludes tokens and PKI material by name.

Egress is declared, and refused when it cannot be met

A runtime spec states what network access it needs. The host enforces it — and a spec asking for something the host cannot enforce is refused rather than silently downgraded.

That refusal is the load-bearing half. A platform that quietly grants less than you asked for has told you nothing, and you will find out from an incident.

Isolation is a declared capability, not a marketing word

Every host publishes what it can actually do through the standard capability contract, and the CLI reads it. A laptop that cannot do process checkpoint reports false; so does a managed host that cannot.

The vocabulary is public and it is the same everywhere, so "hardened" is a claim you can check rather than a word on a page.

What we declare: a kernel per workspace

Managed workspaces run in microVMs — each one gets its own guest kernel rather than a slice of a shared one. Our hosts declare isolation.microvm; a laptop running the open edition declares isolation.container.

Same node model, same verbs, same snapshot format. The driver underneath is a property of the host, not a different kind of Baton — and a self-hosted machine can declare the same thing we do.

Audit names a key, never "the cloud"

Every action resolves to one specific key that one specific person added, with the scopes it was granted visible wherever it is listed. Revocation is deleting that key, and it takes effect immediately — verification happens at time of use, so there is no issued token to outlive the record.