# Security Model

The Overra Security Model defines the guarantees, assumptions, and boundaries under which the system operates. Overra does not claim universal protection. It defines a constrained, deterministic enforcement layer between wallet authority and endpoint state. Security is derived from cryptographic verification, explicit trust boundaries, and minimal attack surface.

***

### Security Objectives

**Overra is designed to guarantee:**

1. Only the registered wallet can authorize containment.
2. Unauthorized or replayed requests cannot mutate state.
3. State transitions are deterministic and auditable.
4. Enforcement occurs locally without centralized override.
5. Containment actions are constrained and predefined.

The system prioritizes predictability over flexibility.

***

### Trust Assumptions

Overra operates under the following assumptions:

#### 1. Wallet Private Key Integrity

The registered wallet’s private key remains secure.

If the private key is compromised, containment authority may be abused.

Overra cannot protect against compromised signing keys.

***

#### 2. Local Agent Integrity

The local agent binary is trusted and has not been tampered with.

If the agent is modified maliciously, security guarantees may degrade.

Future integrity verification mechanisms may strengthen this boundary.

***

#### 3. Operating System Reliability

The host operating system correctly enforces network, session, and process restrictions.

Overra assumes OS-level enforcement functions behave as expected.

***

### Threats Mitigated

Overra mitigates:

* Unauthorized containment triggers
* Replay attacks using previously valid signatures
* Delayed execution of expired authorizations
* Cross-device authorization reuse
* Centralized override abuse

It introduces deterministic enforcement where none previously existed.

***

### Out of Scope

Overra does not protect against:

* Compromised wallet private keys
* Physical device compromise
* Kernel-level rootkits
* Operating system backdoors
* Advanced persistent malware with system-level privileges

These risks exist outside the containment model’s defined boundary.

***

### Minimal Attack Surface

Overra intentionally excludes:

* Remote shell interfaces
* Arbitrary command execution
* Dynamic scripting engines
* Centralized enforcement servers
* Runtime policy downloads

Limiting capability reduces exploit surface.

Security improves when functionality remains constrained.

***

### Deterministic Enforcement Boundary

Containment occurs only after:

* Valid signature verification
* Authority match
* Nonce validation
* Timestamp validation
* Expiration window validation

If verification fails, state remains unchanged.

There are no fallback mechanisms.

There is no discretionary override.

***

### Audit and Transparency

Every authorization attempt and state transition is logged.

There are no silent containment events.

Security actions are traceable and reviewable.

Auditability strengthens operational confidence.

***

### Security Philosophy

Overra does not attempt to eliminate all endpoint risk.

It introduces a deterministic containment primitive governed by cryptographic authority.

Security is strengthened by:

* Explicit boundaries
* Minimal scope
* Deterministic behavior
* Local enforcement
* Verifiable authorization

Containment becomes structural rather than discretionary.

***

### Model Summary

Overra guarantees that:

Valid wallet signature → Deterministic state transition → Local enforcement → Logged event.

Nothing else can mutate containment state.

Security is achieved through constraint, not expansion.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://overra.gitbook.io/overra-docs/security-model.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.