Anti-Tamper & Separation of Duties

import { TealEngine } from 'tealtiger';

// This throws ForbiddenConfigError and emits tamper alert
const engine = new TealEngine({
  policy: myPolicy,
  // ❌ These keys are forbidden:
  governance: {
    disable: true,           // FORBIDDEN: Cannot disable governance
    bypassFreeze: true,      // FORBIDDEN: Cannot bypass FREEZE rules
    suppressAudit: true,     // FORBIDDEN: Cannot suppress audit events
    allowUnsignedBundles: true  // FORBIDDEN: Cannot skip bundle verification
  }
});

// Error: ForbiddenConfigError
// code: 'FORBIDDEN_CONFIG_KEY'
// keys: ['governance.disable', 'governance.bypassFreeze', ...]
// Alert emitted to tamper detection channel

const engine = new TealEngine({
  policy: myPolicy,
  antiTamper: {
    forbiddenKeys: [
      // Default forbidden keys (always included)
      ...TealEngine.DEFAULT_FORBIDDEN_KEYS,
      // Organization-specific additions
      'compliance.hipaa.disable',
      'compliance.gdpr.disable',
      'costLimits.override',
      'encryption.disable'
    ]
  }
});

import { BundleValidator } from 'tealtiger/security';

const validator = new BundleValidator({
  // Public key for bundle signature verification
  signingKey: {
    type: 'rsa-pss',
    publicKey: process.env.BUNDLE_SIGNING_PUBLIC_KEY
  },
  // Require both integrity hash and signature
  requirements: {
    integrityHash: 'required',   // SHA-256 hash of bundle contents
    signature: 'required',       // RSA-PSS signature
    timestamp: 'required',       // Bundle creation timestamp
    maxAge: '24h'               // Reject bundles older than 24 hours
  }
});

// Validate before loading
const bundle = await fetchPolicyBundle();
const validation = await validator.validate(bundle);

if (!validation.valid) {
  console.error('Bundle validation failed:', validation.errors);
  // [{ type: 'SIGNATURE_INVALID', message: 'Bundle signature does not match content' }]
  // Tamper alert emitted automatically
}

interface PolicyBundle {
  /** Bundle metadata */
  metadata: {
    version: string;
    createdAt: string;
    createdBy: string;
    description: string;
  };

  /** Policy rules */
  rules: PolicyRule[];

  /** Module configurations */
  modules: Record<string, unknown>;

  /** Integrity fields */
  integrity: {
    /** SHA-256 hash of canonical bundle content */
    hash: string;
    /** Algorithm used */
    algorithm: 'sha256' | 'sha384' | 'sha512';
  };

  /** Digital signature */
  signature: {
    /** Base64-encoded signature */
    value: string;
    /** Signing algorithm */
    algorithm: 'rsa-pss-sha256' | 'ecdsa-p256-sha256';
    /** Key identifier */
    keyId: string;
    /** Signature timestamp */
    timestamp: string;
  };
}

Bundle Received
      │
      ▼
┌─────────────────┐     FAIL     ┌──────────────────┐
│ Check hash      │ ───────────► │ REJECT + Alert    │
│ (SHA-256)       │              │ BUNDLE_INTEGRITY  │
└────────┬────────┘              └──────────────────┘
         │ PASS
         ▼
┌─────────────────┐     FAIL     ┌──────────────────┐
│ Verify signature│ ───────────► │ REJECT + Alert    │
│ (RSA-PSS)       │              │ BUNDLE_SIGNATURE  │
└────────┬────────┘              └──────────────────┘
         │ PASS
         ▼
┌─────────────────┐     FAIL     ┌──────────────────┐
│ Check timestamp │ ───────────► │ REJECT + Alert    │
│ (max age)       │              │ BUNDLE_EXPIRED    │
└────────┬────────┘              └──────────────────┘
         │ PASS
         ▼
┌─────────────────┐
│ Bundle ACCEPTED │
│ Load policy     │
└─────────────────┘

import { WorkloadBinding } from 'tealtiger/security';

const binding = new WorkloadBinding({
  // Verify the governance engine's own identity
  platform: 'kubernetes',  // or 'aws-ecs', 'azure-aci', 'gcp-cloud-run'
  verification: {
    // Kubernetes: verify service account and namespace
    serviceAccount: 'tealtiger-engine',
    namespace: 'governance',
    // Verify pod identity token
    tokenAudience: 'tealtiger-governance-engine'
  },
  // Bind to specific infrastructure
  infrastructure: {
    // Only run on nodes with specific labels
    nodeSelector: { 'security-tier': 'governance' },
    // Verify cluster identity
    clusterIdentity: 'arn:aws:eks:us-east-1:123456789:cluster/production'
  }
});

// At startup, verify workload identity
const verified = await binding.verify();
if (!verified.valid) {
  // Engine refuses to start if workload identity doesn't match
  console.error('Workload identity verification failed:', verified.reason);
  process.exit(1);
}

import { TealEngine, Capabilities } from 'tealtiger';

const engine = new TealEngine({
  policy: myPolicy,
  capabilities: {
    // What the application is allowed to do
    allowed: [
      Capabilities.EVALUATE,           // Can evaluate requests
      Capabilities.READ_DECISION,      // Can read decisions
      Capabilities.APPROVE_DECISION,   // Can approve pending decisions
    ],
    // What the application is NOT allowed to do
    denied: [
      Capabilities.MODIFY_POLICY,      // Cannot change policy at runtime
      Capabilities.MODIFY_FREEZE,      // Cannot touch FREEZE rules
      Capabilities.DISABLE_MODULES,    // Cannot disable governance modules
      Capabilities.EXPORT_EVIDENCE,    // Cannot access raw evidence
      Capabilities.MODIFY_NHI,         // Cannot modify NHI registry
    ]
  }
});

// Attempting a denied capability throws CapabilityDeniedError
try {
  await engine.loadPolicy(newBundle);  // MODIFY_POLICY capability required
} catch (error) {
  // error.code === 'CAPABILITY_DENIED'
  // error.capability === 'MODIFY_POLICY'
  // Tamper alert emitted
}

// Role-based capability sets
const DEVELOPER_CAPABILITIES = [
  Capabilities.EVALUATE,
  Capabilities.READ_DECISION,
  Capabilities.APPROVE_DECISION
];

const GOVERNANCE_ADMIN_CAPABILITIES = [
  Capabilities.MODIFY_POLICY,
  Capabilities.MANAGE_FREEZE,
  Capabilities.CONFIGURE_MODULES,
  Capabilities.MANAGE_NHI
];

const SECURITY_OPS_CAPABILITIES = [
  Capabilities.READ_EVIDENCE,
  Capabilities.CONFIGURE_SIEM,
  Capabilities.MANAGE_ALERTS,
  Capabilities.SUSPEND_AGENT
];

# tealtiger.config.yaml
antiTamper:
  enabled: true

  forbiddenKeys:
    - governance.disable
    - audit.disable
    - freeze.disable
    - nhi.bypass
    - proof.disable

  bundleIntegrity:
    required: true
    signingKey:
      type: rsa-pss
      keyId: bundle-signing-key-prod
      # Public key loaded from secrets manager
    maxBundleAge: 24h

  workloadBinding:
    platform: kubernetes
    serviceAccount: tealtiger-engine
    namespace: governance

  capabilities:
    applicationRole: [evaluate, read_decision, approve_decision]
    # Admin and SecOps capabilities managed via separate control plane

  tamperAlerts:
    channel: security-critical
    destinations:
      - type: pagerduty
        severity: critical
      - type: siem
        format: cef