Privilege in two planes

On this fleet, power and daily work never share a session. The account that does the work holds no administrative rights and no fleet credentials, by design, and the power to change the fleet lives on a separate plane that is entered deliberately and left quickly. What follows is the construction of the split, the privileged window that bridges it when infrastructure must actually change, and the reason the arrangement exists: the daily seat works on untrusted input, and a session that holds no power cannot be tricked into using it.

The split, on three axes

The two planes are separated three times over, because any single separation can be walked around.

accountsevery box carries a powerless working account and a separate administrative one. Daily sessions run as the first and cannot elevate: the attempt is denied, and the denial is a verified state, checked from the seat.

keysthe key that opens the daily seat opens nothing else, and the administrative accounts answer to a different key entirely. Revoking either plane touches nothing of the other, and a revocation is proven the standing way: the removed key is tried and must be refused.

credentialsthe platform credential that can reshape the fleet does not exist as a standing thing. It is minted under separate strong authentication when a window needs it and removed after, so there is no long-lived infrastructure credential to steal. The one standing credential reads the bill, and can do exactly that.

The window

Infrastructure still has to change, and the window is how power gets used without moving in. Three phases, in the same order, every time.

Request, written on the seat, into the record. What is needed and why. The source of anything to be installed, with its trust grade. The exact commands. The network sources the window is expected to touch, and the file changes the monitoring should see. Authoring this converts the moment of power from an open shell into the execution of a reviewed list, and the request document is the review surface.

Execute, by the human, on the admin plane, in a separate session, time-boxed. Only what the request names is run, and nothing else is done while power is in hand. No agent is present: for a command list, a plain shell and copy-paste is the whole tooling, and an agent on this plane would be a named exception with its own review, which has never yet been worth it.

Verify and record, back on the seat. The capability is confirmed to work. What the monitoring actually saw during the window is read against what the request declared, and an undeclared event is a finding. The request's status is flipped in the record, and the change lands in the box's own ledger, so the fleet document and the live fleet move together. Then the power is put down, and the putting down is proven by an attempt that must fail.

One window, two lanes. The request is authored where the work happens, on the powerless seat, and crosses to a human as a reviewed list. Execution runs with power in hand, time-boxed, nothing outside the list. Verification lands back on the seat, reading what actually fired against what was declared, and the close puts the power down with a refused attempt as the proof. The stream underneath is the fleet's ordinary monitoring, which never stops during the window.

The standing rules

root runs signed packages onlythe distribution's archive is the only thing executed with power. Third-party code lands user-space on the powerless account, where the blast radius is one account. The named catch: a browser binary once ran as root during convenient provisioning, which is exactly the class the rule exists for.

declare before, read afterthe window names the network sources it expects to touch before it opens, and what fired is read against the declaration after. Without the declaration the reading rots into a rubber stamp, so the declaration is what keeps the after-check meaning something.

the agent never holds powernot in a window, not scheduled, not unattended, not as an exception for speed. A window is attended human work by definition.

batch the windowsfewer, larger, reviewed lists beat frequent small elevations. The request documents accumulate into the rebuild map, so every window also improves the script that would rebuild the box from nothing.

Why the seat stays powerless

The daily seat's sessions work on untrusted input all day: fetched pages, repositories, briefs, other people's documents. Injected instructions riding in such input are a real attack class, and no reading discipline reliably catches them, for the same reason no review catches every script tag in a long capture: the volume of intake is the point of the work. The split answers the problem structurally. Whatever poisons a session on the seat can at most author a request, because the session holds no power to execute. The request then faces a human on the other plane, reading a concrete list of commands. The first catch on record was the mildest possible version of the class: a working session asking for elevated rights because elevation would have been convenient. The design's answer is the same for the convenient case and the malicious one.

What the split does not do is make the seat harmless, and the design says so. The seat holds the knowledge base and can damage what it holds. That risk is carried by different machinery: the write gate that refuses malformed changes, the record that makes every change reviewable, and the grounding that keeps claims tied to sources, on the write gate and grounding a claim. The plane split carries exactly one promise: nothing that happens inside a working session can change what the fleet is. The narrative of the fleet is the fleet chapter.