Trusted Execution Environments

Encryption at rest protects stored data. TLS protects data in transit. Both leave a gap: while a program runs, its data sits in memory in the clear, readable by anyone with sufficient privilege on that machine: including the operator.

A Trusted Execution Environment closes that gap with hardware. Memory is encrypted by the CPU, and code outside the enclave (the host OS, the hypervisor, the cloud provider's administrators) cannot read it.

• AMD SEV-SNP and Intel TDX encrypt an entire virtual machine's memory.
• Intel SGX isolates smaller enclaves within a process.
• Remote attestation lets a third party verify what is running inside before trusting it with data.

Attestation is the part that makes this useful rather than merely comforting. The hardware signs a measurement of the code and configuration loaded into the enclave, and a remote party checks that signature against the expected value before releasing any secret to it.

This is what makes a TEE a good place to put an inspection proxy. Traffic can be decrypted, examined, and re-encrypted inside the enclave, so sensitive content is inspected without the operator being able to observe it. That pattern reappears in the agent threat model track, where the traffic being inspected is prompts and completions.