Zero Trust,
in someone else’s cloud.
The ten commandments of building platforms that deploy and operate software inside customer-owned environments: no shared perimeter, no ambient trust, and every credential, connection, artifact, and permission must justify itself.
The trust paradox in modern infrastructure: as a vendor, you keep operational responsibility for your product (provisioning, upgrades, scaling, and incident response) while your customer keeps the account it all runs in, along with data residency, cloud spend, and compliance posture. Your systems must operate inside a perimeter that is fundamentally closed to you. That arrangement has a name: BYOC, Bring Your Own Cloud, the deployment model in which your software runs inside your customer's environment, pairing the managed experience of SaaS with the data control of self-hosting.
Building for that boundary is hard because perimeter thinking stops working the moment you cross it. There are two accounts, two networks, and two owners, and every credential, artifact, and action now moves between parties with different interests. Zero trust becomes the working model: verify every identity, scope every privilege, expire every credential, gate every artifact, record every action, and make every grant revocable by the party who granted it.
Your control plane is where those obligations concentrate. Its job is to hold desired state, publish signed artifacts and configuration, broker short-lived identity, and collect the evidence that proves what your agent did. It must never hold customer data, long-lived credentials into customer accounts, or a position on the customer's data path. Everything that touches data, keys, backups, and end-user traffic belongs in the customer account, run by an agent that pulls its instructions and reconciles toward them.
The diagram below maps the mechanics of the trust boundary across three example architecture models from Omnistrate (BYOC-Account / BYOC-VPC, BYOC-K8s (Kubernetes), and Air-gapped), showing where the control plane brokers short-lived identity and how network access adapts as isolation requirements tighten.
- I.The Sovereign Data PlaneSplit the system at the account boundary, organize it as cells, and keep every derived form of the data (backups, snapshots, keys) in customer custody→
- II.Connectivity Without ExposureA spectrum of control-plane connectivity, from reverse tunnels to PrivateLink to air-gapped, with the same trust properties at every point→
- III.The Data Path Is the Customer'sEnd-user traffic reaches the product over customer-controlled networking (internal load balancers, VPC peering, PrivateLink-style endpoints, or the customer's own public edge) with no vendor component in the path→
- IV.Identity Over SecretsMutual TLS with per-cell identity plus workload identity federation, so no static key exists in either direction→
- V.The End Customer Makes the RulesCeilings, phased grants, and runtime privilege changes: building a control plane parameterized by customer-set permissions→
- VI.A Supply Chain the Customer Can GateImages and charts mirror into customer-owned registries so existing scanning, signing, and admission policies apply to vendor software→
- VII.Reconcile, Don't CommandThe control plane ships desired state through a typed contract; an in-account agent reconciles it, retries idempotently, and self-heals drift locally→
- VIII.Every Action Leaves Two TrailsAttribution, completeness, tamper evidence, correlation, and delivery: every agent action answerable in the customer's own tooling→
- IX.Revocable by DesignCustomer-side trust anchors let the customer revoke access per phase, per cell, per session, or all at once, the moment they decide to→
- X.Exit Is a FeaturePortability is the last line of sovereignty: the same service definition runs hosted, BYOC, on-prem, or air-gapped, and the data is already in the customer's account→
These commandments come from production experience operating many BYOC control planes across multiple clouds, regulatory environments, domains, products and teams. Like the twelve factors that inspired their form, they are written to outlive any one implementation.