Cross-organisation trust between two OpenShell deployments — measured across the Atlantic

[raulipadding]

Hi OpenShell team & community, (AI assisted, read and curated by me)

Full disclosure up front: this post is about our technology. I'm sharing it because I'd value your read on whether trust between organisations is something OpenShell wants to address.

The question. OpenShell keeps one organisation's agents safe inside their sandboxes. What happens when an agent in org A needs to call a service that runs in org B's OpenShell, and the two share no identity provider?

What we tried. Two organisations, each on stock OpenShell v0.1.5 (packaged mTLS posture, Docker driver), with nothing changed on the OpenShell side:

• Org A, in Ashburn, VA: agents in sandboxes hold only a provider placeholder. OpenShell's egress proxy resolves it for org A's border gateway, which attaches a fresh credential to each outgoing request.
• Org B, in Helsinki: a door in front of org B's service route checks each request locally. There is no call back to org A and no token exchange. Neither a third party auth server.
• 118 ms round trip between them. Org B opened two ports, to org A's address only.

What we measured on 22 October 2026:

• +0.34 ms median added per request across the Atlantic, against a 121 ms baseline on the same path without authentication (16,000 requests at 200 per second, none failed). +0.21 ms with both organisations on one host.
• A credential captured on its way across and presented again: refused 15 times out of 15, never reaching the service.
• Org A revoking one agent: first refusal after 43 ms (median), with its sibling agent unaffected. Org B cutting the whole partnership: refused from the door's next one-second tick.
• The network between the two cut for 10 s, three times: every credential that arrived late was refused on arrival and re-sent fresh by org A's gateway, the first request after the link came back was admitted within 50 ms, and both sides' evidence records stayed intact.

Things we noticed about OpenShell itself, offered as feedback:

1. openshell --gateway <name> status exits 0 for a gateway that was never registered (it prints "No gateway configured"), so a setup script that checks the exit code never registers the gateway on a fresh host. Happy to open an issue if that's useful.
2. When the link came back, a burst of delayed requests reached org B's service route at once, and the route answered 502 with "per-sandbox relay limit reached (32 in flight)". On main this still looks like a fixed constant (MAX_PENDING_RELAYS_PER_SANDBOX = 32). Between organisations, a partner's backlog can arrive all at once after a network blip; would you consider making the limit configurable?
3. During the cut, org A's sandbox logged "Sandbox network relay streams exhausted; new sandbox TCP connections are waiting for a relay to close", which held new agent requests until the link returned. Is that the expected behaviour?

Questions for the maintainers:

• Is trust between organisations (an agent in one OpenShell deployment calling a service in another) in scope for OpenShell's design?
• If integrations like this are welcome, where would you prefer them described: a discussion like this one, the docs, or somewhere else?

A short deck with the results attached.
EdSSA across the Atlantic — OpenShell edition.pdf

Glad to share more of the measurements here. And thanks for OpenShell: standing up two organisations on it was quick.

I'm Tomas Westerholm, founder of EdSSA, a patent-pending authentication technology for machine-to-machine traffic, built in Finland, thrilled by the momentum.

---

Not a Contribution: this post and my replies in this thread are shared for discussion only and are not Contributions under the Apache License 2.0.