Why read-only is a feature, not a limitation

Security tools ask for remarkable things. Admin credentials. Agents on every workload. A write path into the systems they claim to protect. The industry treats this as the cost of doing business — you can't fix what you can't touch.

We think that trade is upside down, and we built kaveo to prove it.

Write access is how tools become incidents

Count the major security incidents of the last five years where the security tooling itself was the vector. Supply-chain compromises of monitoring agents. Management consoles with remote code execution. Credential stores that became credential buffets. Every one of those products had a write path, and the write path is what turned a bug into a breach.

A tool that can only read has a different worst case. If kaveo is compromised — bad build, bad dependency, bad insider — the blast radius is a stale or falsified report. That is a bad day. It is not an incident response.

What read-only forecloses, honestly

Refusing write access costs us features, and pretending otherwise would violate our own copy rules. kaveo does not auto-remediate. It will not rotate the credential it flagged or close the security group it caught open. You keep a human — or your own automation, with your own change controls — between finding and fix.

We consider that a feature too. Auto-remediation moves the write path into the vendor's blast radius and takes the change record out of your process. The teams we serve — regulated, air-gapped, audited — are precisely the teams that cannot outsource that judgment.

Read-only must be provable

A read-only promise is marketing. A read-only architecture is checkable:

• The scanner role carries AWS-managed SecurityAudit and ViewOnlyAccess policies. Nothing custom, nothing broad. You can diff the policy we document against the policy you deployed.
• The role is constrained by a per-install external ID, so it cannot be assumed from anywhere else.
• There is no outbound connection to receive a write instruction on. No control plane, no command channel, no phone home.

When a prospect's security team reviews kaveo, we hand them the Terraform and let them read. That review meeting is the product demo.

The bet

Our bet is that the next decade of security tooling gets judged the way the rest of the stack already is: least privilege, provable claims, smallest possible blast radius. Read-only is not what we couldn't build past. It is the constraint that makes everything else about kaveo trustworthy.