Security model

The AI never gets a shell account. It gets a set of tools whose limits are enforced on the device and whose risky calls a person approves.

• Outbound-only: the agent connects out over TLS; no listening port, no SSH key on the machine.
• Least privilege: the agent runs as a normal user, inside allowed folders only; writes and commands can be switched off per device, on the device.
• Approvals: high-risk actions need a single-use approval bound to the exact action and device.
• AI clients cannot change their own limits: trust levels, autonomous mode and allowed commands are changed only by an admin in a browser session or the Management Center.
• Secret masking: tokens, passwords and private keys in command output are masked before they leave the device.
• Audit: every tool call, approval and policy change is logged with who, what and when.