Workstation Entitlements & Controls
Clipboard Isolation
Block bidirectional host-to-desktop clipboard sync
TCP Port Forwarding Lockdown
Prevent developer tunneling local ports to VPC resources
eBPF Node-Level Session Audit
Capture raw syscalls, network sockets & binary execution
Hardware WebAuthn / MFA per Command
Require TouchID / YubiKey tap for sudo & cluster actions
Dual-Auth Preshared Sudo Approval
Escalations require real-time Slack/PagerDuty peer signoff
Live Blast Radius & Lateral Risk Engine
Status: Contained
Backend-Dev-Arch
Dev Role
Session: Isolated X11/Wayland
Cert Expiry: 60m TTL
Teleport Auth / Proxy
eBPF + WebAuthn Active
Production VPC
Secured
Postgres (Tier-1), K8s Prod, Gateway API
Downstream Production Reachability Matrix
| Target Asset | Criticality | Lateral Vector | Access Verdict |
|---|