OAKAI RESEARCH • OCTOBER 2026

The Blast Radius Architecture: Path-Scoped Machine Tokens vs Global Secrets

How fine-grained path-prefix access control lists (ACLs) prevent an attacker with remote code execution (RCE) on an edge web service from pivoting into infrastructure keys.

1. The Global Secret Anti-Pattern

In many container clusters, all microservices share a single master secret store API token. If a public-facing container (e.g. an image transcoder or webhook consumer) is hit with an RCE vulnerability:

Total Network Compromise: The attacker dumps /proc/self/environ, extracts the global token, and uses it to query the company's Stripe private keys, database root credentials, and SSH keys.

2. Path-Scoped Enclaves in Sovereign Vault

Sovereign Vault enforces least privilege via cryptographic machine identities bound strictly to path prefixes:

// Token Policy Definition
{
  "name": "transcoder-worker",
  "project": "media",
  "allowed_paths": ["apps/transcoder/*"],
  "capabilities": ["read"]
}

When transcoder-worker queries apps/transcoder/s3_key, the request returns HTTP 200 OK. If the compromised worker attempts to query infra/database/root_pass, the engine terminates the request with HTTP 403 Forbidden: Path outside permitted token scope.