Runtime Execution Control Model

🌟 Objective

To ensure that the application, after deployment, executes in a secure, controlled and reversible way, through mechanisms that make it possible to limit impact, respond to failures, activate or deactivate functionality and prevent dangerous executions in production.

These controls operate during the execution of the application, complementing the pre-deployment tests and the CI/CD controls, and are fundamental to supporting:

• Reversibility and impact containment;
• Active monitoring and response capacity;
• Progressive deployment and real-time security.

---

🧬 What execution control is

Execution control refers to all the mechanisms applicable at runtime that make it possible to condition, block, adjust or switch off application functionality without a new deployment.

Typical examples are:

Type	Description	Practical example
Feature Toggle	Dynamic activation or deactivation of functionality	Launching a new feature for 5% of users
Circuit Breaker	Automatic interruption of external calls in case of repeated failure	Stopping calls to an external API after 3 timeouts
Timeout / Quota	Limitation of time or resource usage	2s timeout for internal calls
Kill Switch	Switching off functionality in case of incident or risk	Deactivating the sending of notifications after an anomaly
Runtime Guard	Verification of preconditions before executing sensitive logic	Checking that a token is signed before using it

---

🛠️ How to apply

1. Identify points of risk or dynamic control in the code:

   • External calls, new functionality, critical operations;

2. Apply conditional execution mechanisms, with external control:

   • Environment variables, centralised configuration, toggle panels;

3. Include active monitoring of the effects of the control:

   • Metrics, alerts, activation/deactivation logs, failure tracking;

4. Document the fallback behaviour of each control:

   • What happens if it is activated/deactivated - expected impact;

5. Test the control mechanisms periodically:

   • Simulate failures, incidents, load, and rollback validations.

---

✅ Good practices

• Use feature toggles with a time limit (e.g. 30 days);
• Document the logic of each control and ensure reversibility;
• Include runtime guards for critical data (e.g. validation before executing);
• Treat circuit breakers as security measures, not only resilience measures;
• Ensure that toggles and switches are auditable and versioned;
• Prefer centralised and secure configuration (e.g. HashiCorp Consul, AWS AppConfig);
• Validate that the code executed matches the environment (e.g. staging ≠ production).

---

📎 Cross-references

Document / Chapter	Relation to this topic
Ch. 07 - Secure CI/CD	Validation of environments and execution by pipeline
Ch. 10 - Security Testing	Functional tests of toggles, guards and fallbacks
Ch. 12 - Monitoring and Operations	Runtime observability and response to failures
SLSA L3/L4	Verified execution, controlled environments
NIST SSDF PR.AC-3	Authorised execution control

---

🔐 Runtime execution control is a critical element of operational security, making it possible to prevent, contain or mitigate the impact of changes without requiring a new deployment - essential for high-criticality and high-availability environments.