Runtime Security

Concepts

Runtime permissions

Run Vega Runtime with least privilege. The Runtime service account should access only the configuration, data locations, device interfaces, network destinations, and Capability resources required by the approved deployment. Limit host administration, configuration changes, Capability installation, and operational controls to authorized roles.

Credentials and secrets

Use an approved secret manager, deployment service, or orchestrator secret facility for credentials. The current public live-voice behavior recognizesGEMINI_API_KEY,GOOGLE_API_KEY, andGOOGLE_GENAI_API_KEY. Treat all three as secrets.

Do not put secrets in YAML, source control, container images, shell history, support tickets, screen recordings, or shared logs. Confirm that a secret is provided to the service that runs Vega Runtime, not merely to an administrator's interactive shell.

Example pattern:

# Obtain the value through your organization's approved secret process.
export GEMINI_API_KEY='managed-secret-value'
python -m vega run --mode normal --live-voice

Secure configuration and artifacts

Configuration files should be reviewed, access-controlled, and separated from credentials. Use unique deployment identity registration for each robot or host. Install Vega Runtime and Capability packages only from approved release channels. Pin approved release versions and preserve provenance information for production deployments.

Offline deployment

Offline deployments require a written policy for trusted release transfer, credential provisioning, time and log handling, updates, backups, incident response, and emergency operator control. Verify artifact integrity through the organization's approved release process before transfer. Do not bypass security review merely because a deployment is isolated from the internet.

Telemetry

Define telemetry before production rollout: what information is collected, why it is needed, where it is stored, who can access it, how long it is retained, and how it is protected. Collect only the operational information required by your approved policy. Redact secrets and sensitive personal or site data before sharing diagnostics externally.

Enterprise security recommendations

• Use dedicated service accounts and role-based access controls.
• Apply host security updates through an approved maintenance process.
• Segment network access according to the Runtime's approved dependencies.
• Encrypt and back up Runtime data according to organizational policy.
• Rotate credentials and remove access when a user, host, or deployment retires.
• Maintain audit records for releases, configuration changes, and privileged operations.
• Exercise incident response and recovery procedures before a production event.

Best practices

• Keep secrets out of all Runtime configuration examples and logs.
• Restrict write access to configuration, Runtime data, and Capability packages.
• Verify Runtime readiness after every security-related configuration change.
• Treat unapproved artifacts, credentials, and host modifications as security incidents until reviewed.

Common pitfalls

• Treating environment variables as automatically secure.
• Sharing a credential through a ticket or chat message to resolve an issue.
• Installing a Capability from an unapproved source.
• Granting broad host permissions to simplify a deployment.
• Confusing a private network with a complete security boundary.

Related documentation