Least privilege, human control, and claims you can check.
ChangeGuard is designed to earn its way into your production path — read-only by default, honest about what it reads, and incapable of acting beyond the autonomy you grant. Here is exactly how it behaves.
In your cluster
| Property | How it behaves |
|---|---|
| Cluster-admin | Not required. No wildcard verbs or resources are requested anywhere. |
| Default access | Read-only. The collector and operator use get/list/watch to read cluster state. |
| Secrets & RBAC | The operator and collector read Secrets and RBAC objects cluster-wide (read-only) to find your API-key secret and to discover Helm/GitOps state. They never read Secret values back to the control plane, and never write to Secrets. We disclose this rather than claim “no secret access.” |
| Write access | None by default. Remediation write access is opt-in, namespaced, and scoped to specific workload kinds by an RBAC Role you apply — no delete verb, no Secrets, no RBAC writes. |
| Execution authority | Lives in your cluster. The control plane never holds your cluster credentials. |
| Footprint | Two namespaces, one CRD, a small collector (~50m CPU / 64Mi memory requested). No PersistentVolumes. Non-root, read-only root filesystem, all Linux capabilities dropped. |
| Egress | One direct HTTPS (443, TLS 1.2+) connection to api.changeguard.ai. Outbound HTTP proxy is not currently supported. |
The full permission matrix and how to inspect installed RBAC are in the docs.
In the control plane
Tenant isolation
Every tenant’s data is isolated at the database with PostgreSQL row-level security. Requests without a valid tenant context are rejected.
Authentication
Email/password sessions (signed, httpOnly cookies) with role-based access, plus scoped API keys for agents and CI/CD. Rate-limited. (SSO/SAML is on the roadmap.)
API keys
Scoped (agent, cicd, read-only) and shown once at creation, then stored hashed. Rotate by creating a new key and revoking the old.
Evidence-backed claims
The backend owns facts and numbers; the model only writes language. An uncited reason is dropped rather than shown.
Human approvals
Below Auto, every action requires a human to approve it. Auto acts only inside an explicit policy (namespaces, fix types, confidence floor, hourly cap).
Fail closed
Missing or suspect evidence means ChangeGuard says less, not more — it would rather stay silent than assert something unverified.
What ChangeGuard can and cannot do
It can
- Read your cluster state and correlate changes to incidents
- Recommend fixes and score deploys (advisory)
- Apply a fix only at Approve/Auto, within your policy, then verify it
- Perform one audited rollback if a fix fails verification
It cannot (by design)
- Act beyond your autonomy level or execution policy
- Block your deploys — pre-flight is advisory
- Write to Secrets or RBAC, or delete workloads
- Claim a fix succeeded without verifying it
helm uninstall to remove ChangeGuard from the cluster entirely.Compliance
ChangeGuard helps you evidence controls — it does not itself hold certifications, and we don’t claim it does.
Through CIS benchmarking, CVE and SBOM scanning, RBAC analysis, and audit trails, ChangeGuard maps evidence to common framework controls (SOC 2, PCI DSS, HIPAA, and others) and exports it as CSV/JSON for your auditors. If you need a specific attestation or a data-processing agreement, talk to us — we’ll tell you exactly what’s available today.
Questions from your security team?
We’ll walk through the RBAC, data flow, and boundaries in detail — and tell you honestly what isn’t supported yet.