Isolation follows data sensitivity: a three-tier doctrine

The one-sentence doctrine

Isolation follows data sensitivity. Not convenience, not cost, not whatever the last tutorial recommended — sensitivity decides where a workload lives.

The three tiers

• Tier 1 — on-prem. Sensitive data stays home, behind NAT, with no inbound ports. It never leaves the house.
• Tier 2 — public dedicated server. Multi-tenant client volume and the only public HTTP edge of the whole setup.
• Tier 3 — edge VPS. A static egress IP that third parties can whitelist. It holds revocable, low-privilege keys — never data.

(Full essay pending: the rules each tier enforces, and the failure modes each rule prevents.)

What the tiers are never allowed to do

Never open a port into tier 1. Never store data on tier 3. Never let an LLM into the action path on any tier.

Why this beats a flat setup

The interesting property is what a compromise can’t reach. That argument, worked through per tier, is the body of this essay.