The premise
The detection sidecar reads 100% of your personal data, in plaintext, at its most concentrated. Size the controls for that, not for "it is only an internal service."
In transit
- [ ] TLS between gateway and sidecar, including on private networks and inside a single cluster.
- [ ] Certificate validation pinned to your internal CA rather than falling back to the system trust store.
- [ ] Mutual TLS where the platform provides it cheaply, since it also satisfies caller authentication below.
- [ ] No plaintext HTTP listener, even bound to localhost, even "temporarily for debugging".
At rest
- [ ] Read-only root filesystem.
read_only: true. - [ ]
tmpfs for scratch, with a size limit, so a failure is a failure rather than a disk filling with user text. - [ ] No request bodies written to disk. No spooled uploads. No model cache containing user text.
- [ ] Token vault encrypted at rest, with the key in a KMS.
- [ ] The service holding the vault ciphertext does not hold the key.
- [ ] Vault TTL matched to the conversation lifetime, not to a default retention policy.
- [ ] Backups of the vault covered by the same key separation.
Logs
- [ ] Request and response body logging explicitly off, not merely absent from the current config.
- [ ] Log level set in the image, not inherited from a debugging session.
- [ ] A test asserting that known personal data never reaches the log sink.
- [ ] Field deny-list at the sink:
prompt, completion, body, password, ssn, ein, routingNumber, accountNumber, dateOfBirth. - [ ] Deterministic redaction (Appendix A) applied at the sink, in-process.
- [ ] Log retention set deliberately. Thirty days is usually plenty.
Egress
- [ ] Outbound internet denied at the network layer, not in application configuration.
internal: true, a NetworkPolicy with no egress rule, or a security group with no outbound rules. - [ ] Gateway allowlisted to the model provider host only, everything else denied.
- [ ] DNS egress considered, since exfiltration over DNS does not need an HTTP route.
Provenance
- [ ] Images pinned by digest, not tag.
image: name@sha256:<digest>. - [ ] Signatures verified where the project publishes them.
- [ ] Images mirrored into your own registry.
- [ ] The maintaining organisation recorded, and reviewed quarterly. Presidio moved out of the Microsoft GitHub organisation to community ownership; ownership is not fixed at adoption.
Identity and least privilege
- [ ] Non-root user with an explicit UID.
- [ ]
cap_drop: [ALL]. - [ ]
no-new-privileges: true. - [ ] Its own service identity, not a shared one.
- [ ] Authenticated callers only. Network reachability is not authorisation.
- [ ] No credentials to your database, key vault, object storage, or cloud account.
Lifecycle
- [ ] Patch cadence defined and met. A detection container on an eighteen-month-old base image is a liability.
- [ ] Golden-set regression test in CI, so a model upgrade that halves recall on
PERSON fails a build. - [ ] Quarterly review: who maintains it, what version, when last measured, when last patched.
Gateway specifics
- [ ] Policy versioned in source control, never edited in place.
- [ ] Failure mode set per route and recorded in policy, not implied by a
catch block. - [ ] Degraded-mode operation counted and alerted on.
- [ ] Audit record carries counts and types only, never content.
- [ ] Output host allowlist applied to markdown images, links, and anything else that causes a client fetch.
The boundary
Everything above is the shallow end of a discipline with its own literature and, in several cases, its own full-time roles.
Not covered here: key management and rotation, secrets provisioning and renewal, supply-chain attestation and SBOMs, admission control and pod security standards, runtime detection, network segmentation beyond one deny rule, and threat modelling the deployment itself.
Working through this checklist gives you a detection sidecar that is defensible in a security review and materially better than most deployments of its kind. It is not the same as having done platform security properly, and the failure mode this page exists to prevent is telling anyone that it is.