Hash-chained, append-only record of every action, proposal, refusal and grant. If it can be forged or silently edited, every other control is decoration.
08 · Security
What stops what.
Every claim below is verified against a file and a test on disk.
What the control plane protects
Stored secret values, encrypted at rest on Windows (DPAPI, tied to the signed-in account) or held by an OS keyring backend.
The one file the agent cannot write: the accountable human, the model route, reachable hosts, confinement level, and, optionally, readable roots on this machine. Every other gate reads this boundary.
The one credential that reaches the API today. Rotation locks out a running server, not only a restarted one.
What holds against each attacker class
A local user on the machine
- Token and vault files are written with restrictive permissions; the vault is additionally DPAPI-encrypted on Windows, tied to the signed-in account.
A network peer, if bound remotely
- Loopback is the default and cannot be exceeded without an explicit acknowledgement. Every API route requires a bearer token except health; a failed attempt is journalled without the token itself. Rotation locks out a running server.
A malicious page or tool output reaching the model: prompt injection
- The gate sits outside the model: a proposed action is checked against typed preconditions, host allowlisting, path scoping, mandate matching, regardless of what persuaded the model to propose it. A secret can be named in a proposal but the model never sees its value.
A compromised model host
- The model proposes; it does not execute. Every consequential effect passes through the same outside-the-model gate as ordinary prompt injection.
A compromised authored tool
- A confinement level bounds what a generated tool can do. At the lowest level no generated tool is admissible at all; a secret cannot ride in a subprocess argument.
A stolen backup
- Backups exclude the vault outright: the manifest always records that the vault was not included, and the archive never contains its bytes.
What holds regardless of attacker class
The journal has no update or delete method. Verifying it recomputes every digest and raises on a sequence gap, a broken link, or a tampered payload: append-only and hash-chained, checked, not merely stated.
Summary. Four boundaries are built and tested: loopback-by-default, token authentication, vault exclusion from backups, and the append-only journal.