BYOC Anywhere: The 10 Commandments

b">

a technical framework for bring-your-own-cloud

Zero Trust,<br>in someone else&rsquo;s cloud.

The ten commandments of building platforms that deploy and operate software<br>inside customer-owned environments : no shared perimeter,<br>no ambient trust, and every credential, connection, artifact, and permission must justify itself.

The Multiple Dimensions of Enterprise-grade BYOC

DATA SOVEREIGNTYCONNECTIVITYIDENTITY & PRIVILEGEDELIVERY & OPERATIONSACCOUNTABILITY & EXITIIIIIIIVVVIVIIVIIIIXX<br>ten commandments,<br>five dimensions<br>hover a commandment to see what it covers; click to read it

DATA SOVEREIGNTY<br>IThe Sovereign Data Plane<br>CONNECTIVITY<br>IIConnectivity Without ExposureIIIThe Data Path Is the Customer's<br>IDENTITY & PRIVILEGE<br>IVIdentity Over SecretsVThe End Customer Makes the Rules<br>DELIVERY & OPERATIONS<br>VIA Supply Chain the Customer Can GateVIIReconcile, Don't Command<br>ACCOUNTABILITY & EXIT<br>VIIIEvery Action Leaves Two TrailsIXRevocable by DesignXExit Is a Feature

The trust paradox in modern infrastructure: as a vendor, you keep operational responsibility for your product (provisioning, upgrades, scaling, and incident response) while your customer keeps the account it all runs in, along with data residency, cloud spend, and compliance posture. Your systems must operate inside a perimeter that is fundamentally closed to you. That arrangement has a name: BYOC, Bring Your Own Cloud , the deployment model in which your software runs inside your customer's environment, pairing the managed experience of SaaS with the data control of self-hosting.

Building for that boundary is hard because perimeter thinking stops working the moment you cross it. There are two accounts, two networks, and two owners, and every credential, artifact, and action now moves between parties with different interests. Zero trust becomes the working model: verify every identity, scope every privilege, expire every credential, gate every artifact, record every action, and make every grant revocable by the party who granted it.

Your control plane is where those obligations concentrate. Its job is to hold desired state, publish signed artifacts and configuration, broker short-lived identity, and collect the evidence that proves what your agent did. It must never hold customer data, long-lived credentials into customer accounts, or a position on the customer's data path. Everything that touches data, keys, backups, and end-user traffic belongs in the customer account, run by an agent that pulls its instructions and reconciles toward them.

The diagram below maps the mechanics of the trust boundary across three example architecture models from Omnistrate (BYOC-Account / BYOC-VPC, BYOC-K8s (Kubernetes), and Air-gapped), showing where the control plane brokers short-lived identity and how network access adapts as isolation requirements tighten.

the account boundary is the trust boundary

&larr; flexibilityfully restricted &rarr;

BYOC-Account / BYOC-VPCBYOC-K8s (Kubernetes)Air-gapped

vendor agent provisions and operates infra + services

PLATFORM ACCOUNT · CONTROL PLANECUSTOMER ACCOUNT · DATA PLANETHE TRUST BOUNDARYorchestratorfleet state · workflowsmonitoringhealth · metricsmetering · billingusage eventsreceives status, never datastores no credentialsdeployment cellaws·gcp·azureagentreconciles desired state locallyserviceagent ✓the workload · containersconfig · backups · PITRinfraagent ✓cluster · nodes · networkvolumes + KMS keys · registrycustomer data never leavesPRIVATE CONNECTIVITYoutbound only · mTLSsync statehealthmetricsmeteringno inbound path existsEXPORT AUDIT · CUSTOMER VISIBLE12:04:01health pod/db-0 → healthy12:04:03metrics p99 latency 12ms12:04:06metering cpu_hours +4.212:04:09sync helm/db → Complete12:04:12access jane@ read-only12:04:15health disk 71% → ok12:04:18metering gb_hours +12.812:04:01health pod/db-0 → healthy12:04:03metrics p99 latency 12ms12:04:06metering cpu_hours +4.212:04:09sync helm/db → Complete12:04:12access jane@ read-only12:04:15health disk 71% → ok12:04:18metering gb_hours +12.8vendor agent provisions and operates infra + services inside the customer account<br>PLATFORM ACCOUNT · CONTROL PLANECUSTOMER ACCOUNT · DATA PLANETHE TRUST BOUNDARYorchestratorfleet state · workflowsmonitoringhealth · metricsmetering · billingusage eventsreceives status, never datastores no credentialsdeployment cellany kubernetesagentreconciles desired state locallyserviceagent ✓the workload · containersconfig · backups · PITRinfraplatform teamcluster · nodes · networkvolumes + KMS keys · registrycustomer data never leavesplatformteamPRIVATE CONNECTIVITYoutbound only · mTLSsync statehealthmetricsmeteringno inbound path existsEXPORT AUDIT · CUSTOMER VISIBLE12:04:01health pod/db-0 → healthy12:04:03metrics p99 latency 12ms12:04:06metering cpu_hours +4.212:04:09sync helm/db → Complete12:04:12access jane@ read-only12:04:15health disk 71% → ok12:04:18metering gb_hours +12.812:04:01health pod/db-0 →...