docs/Docs/Security
Defense in Depth

Security Architecture

Bastion implements defense in depth — multiple overlapping security layers that protect agent memory from injection, poisoning, and tampering.

OWASP ASI06 MemoryGuard

Every memory write passes through a 7-stage security pipeline before reaching the database:

1
Prompt Injection Scan
Regex-based detection of 9+ injection patterns
2
Secret Detection
API keys, tokens, passwords — 6 pattern types
3
PII Detection
SSN, email, phone, credit card, IP address
4
Content Size Check
Blocks abnormally large payloads
5
Hash Integrity
Verifies hash chain hasn't been corrupted
6
Trust Scoring
Computes trust level based on source and content
7
Safety Determination
Final pass/fail based on aggregate findings

Cryptographic Integrity

Every memory block is sealed with a SHA-256 hash chain:

python
# Each memory stores:
cryptographic_hash = SHA-256(content + previous_hash)
previous_hash      = SHA-256 of the last block

# If any record is modified:
# Hash chain breaks → detected by memory_audit

A2A Trust Protocol

Agent-to-agent communication uses Ed25519 cryptographic signing:

Ed25519 Agent Cards
Each agent's card is cryptographically signed with its private key
Signature Verification
Receiving agents fetch sender's public key and verify the signature
SSRF Protection
Sender URLs validated against private/internal IP ranges
Key Caching
Public keys cached for 24 hours with LRU eviction (max 100)

Production Security

Brute-Force Protection
10 failures in 10min → 5min lockout. DB-backed + in-memory LRU.
Rate Limiting
600 req/min/IP on A2A. 20 concurrent + 200 queue on MCP.
Request Timeout
60s timeout on all endpoints. Prevents indefinite blocking.
RBAC
3 roles (reader/writer/admin) with skill-level access control.