Security Model

Defense-in-depth security from network edge to model inference.

Security Architecture

FowyldAI implements multiple security layers. Each layer operates independently — a failure in one does not compromise others.

Layer	Mechanism	Default
Network	Built-in network guard blocks all outbound traffic	Enabled
Transport	TLS 1.3 with optional mTLS for API authentication	Configurable
Authentication	API key with scoped permissions	Disabled (local)
Authorization	Per-key scope restrictions (ask, models, health, admin)	All scopes
Input	Request validation, size limits, injection filtering	Enabled
Inference	Sandboxed model execution, memory isolation	Enabled
Audit	Structured local logging of all API interactions	Enabled

Authentication

API key authentication is optional for local deployments and recommended for production.

security:
  api_key_required: true
  api_keys:
    - name: "app-backend"
      key: "fai_xxxxxxxxxxxxxxxxxxxx"
      scopes: ["ask", "models", "embeddings"]
    - name: "monitoring"
      key: "fai_yyyyyyyyyyyyyyyyyyyy"
      scopes: ["health"]

Keys are validated on every request. Scopes restrict which endpoints each key can access.

Transport Security

Enable TLS for encrypted communication. For mutual TLS (mTLS), provide a CA certificate:

tls:
  enabled: true
  cert_path: "/app/certs/server.pem"
  key_path: "/app/certs/server-key.pem"
  mtls:
    enabled: true
    ca_path: "/app/certs/ca.pem"

Input Validation

All incoming requests are validated before reaching the inference engine:

• Size limits: Maximum request body size (default: 1 MB)
• Token limits: Maximum input/output token count per request
• Content filtering: Optional prompt injection detection
• Rate limiting: Per-key or global request throttling

Inference Isolation

Models execute in sandboxed processes with:

• Memory isolation between concurrent requests
• No filesystem access beyond the data directory
• No network access (enforced by network guard)
• Timeout enforcement on all inference operations

Audit Logging

Every API interaction is logged locally with structured metadata:

{
  "timestamp": "2026-04-23T10:15:00Z",
  "event": "api_request",
  "endpoint": "/ask",
  "method": "POST",
  "api_key_name": "app-backend",
  "tokens_in": 45,
  "tokens_out": 312,
  "model": "fowyld-general",
  "latency_ms": 1180,
  "status": 200
}

Logs are written to /app/logs/audit.jsonl and never sent externally.

Security Checklist

Item	Local Dev	Production
API key authentication	Optional	Required
TLS encryption	Optional	Required
Rate limiting	Optional	Recommended
Network guard	Enabled	Enabled
Audit logging	Enabled	Enabled
Docker --network none	Optional	Recommended