Security

An agent is a job somebody described in their own words, turned into a definition they can read, plus the exact permissions it may use. The definition is the thing that runs — attaching a tool to a step is the same act as granting that permission at runtime, so what is on the screen and what the runtime enforces cannot be two different things.

It works in a web browser and nothing else. It cannot touch files on a computer, run a terminal or a build, use an app installed on a machine or a phone, or drive a coding session running locally. If somebody describes a job that needs one of those, the product says so while they are still describing it rather than failing later.

That is the product's own sentence, and it is the one to hold it to. While an agent is reading a page it cannot change anything on it. Every request a page makes is judged by what the agent was doing when it fired, not by the kind of request — which matters, because most of the web reads over the same verb it writes with. Browsing a shop, searching it and filling a basket are reading in this sense. Placing the order is not.

The rule is lifted in exactly two places, both narrow and both temporary.

Inside a sign-in

For the site being signed in to, and the identity provider if the site uses Continue with Google. It ends the moment sign-in finishes.

Inside an approved action

For the site, the action and the amount that were approved. Nothing else, and nothing beyond them.

Reading a page and acting on it are also separate grants on the definition, which is why they appear as two different tools rather than one. A step allowed to read cannot click, type or submit.

Before anything leaves this product, the run stops and shows the exact action: what it will do, which tools and sources it used to decide, the answers to any question it asked, and which version of the agent is asking. The request expires after ten minutes. Denying is not a pause — the downstream model and browser steps do not run, and there are no write tools available to route around it.

An approval is for one site, one action and one amount. A spending cap refuses an approved action above it.

Deciding whether a click is consequential is a judgement, and any judgement can be wrong: a control can be mislabelled, re-rendered, reached by keyboard, or wired to send its request through code rather than a form. So there is a second line underneath that does not read the page at all. While a step nobody approved is in flight, a request that would change something at the sites the agent is working on is held, the run parks, and it records which rule caught it.

A request that arrives a second after the click that caused it still belongs to that click. That case is proved by a fixture rather than asserted.

Where it stops, said plainly: a window goes cold. If nothing the agent did can account for a request — it arrives long after any step that might have caused it — it is not attributed to the agent and it is not held. The backstop covers what the agent caused, not everything a page may eventually do on its own. And a payment already on its way to a bank is past the point where software can recall it; when that happens the run stops and hands it over rather than pretending otherwise.

Agents

What each is for, what it may do, every published version, and the conversation that produced it. Versions are immutable — the database refuses to update or delete one — so a run can always name the definition that produced it.

Runs

What was asked for, every model and tool call with its input and output, the pages observed, stored screenshots, and what it cost.

Connected accounts

An encrypted token where a service issued one. For an ordinary website, an encrypted username and password, in a table whose only reader is the step that types it into the one origin it belongs to.

Files

Anything an agent produced, until it is deleted.

Sessions

A browser, a time, and the address it came from, per signed-in device.

An activity log

Role changes, connections, device sign-outs and exports, with who did them.

• A card number. Not encrypted, not truncated, not briefly. There is no payment processor in this product and no card is held anywhere in it.
• A password in anything readable. A stored site password is encrypted with a key that lives in the environment and never in the database, and it is never selected into a model prompt, a trace, a log or a run's context.
• A password in a conversation. The model is given a placeholder; the real value is typed into the site by the step that decrypts it, and nowhere else.
• A one-time code beyond its use. A texted code is asked for when the site sends one, used, and not kept — it is single use and worthless afterwards.
• Anybody else's email address from a waitlist entry, or a queue position that was never promised.

Everything is scoped to a workspace, and every page and every route checks the role on the server before reading anything. A button hidden from somebody is a courtesy; the thing that stops the action is the check behind it.

Owner

Everything, including billing, members and deletion.

Editor

Build, run and connect. Not billing, not members.

Viewer

Read. Starts nothing.

One exception runs the other way. An Owner cannot see anybody else's signed-in devices or the addresses they connected from. Reading a colleague's IP addresses is surveillance, and being an Owner is not a reason for it.

The activity log is append-only in the database rather than by convention: the table refuses updates and deletes, so not even an Owner can edit it. Exporting it is itself recorded, because somebody taking a copy of who did what is exactly what the next reader wants to know about.

Signing out everywhere ends every other session immediately and leaves the browser in use alone. Any single connected account can be removed from the Accounts page: an encrypted token is deleted, and a site sign-in is detached from the browser profile that held it.

Not live yet. Deleting an account and all of its data on request is not built. Doing it properly means removing runs, steps, files, tokens and the rows the sign-in library owns, in an order that strands no reference — get that wrong and somebody is left half deleted. The button on the Security page in the product records a dated request and says, in those words, that nothing has been removed. It does not pretend to have deleted anything.

Three things an agent might be asked for are designed, visible in the product, and not running. These are read from the single list the product itself consults when it has to say so to somebody mid-conversation, so this page cannot drift from what the product tells them.

• checkout, the product says: “completing the payment itself, so it fills the basket and stops at your approval”.
• schedule, the product says: “starting a run on that schedule, which is saved and has nothing to run it”.
• site-signin, the product says: “signing in to those sites, which is built and has not yet worked on a real one”.
• history-study, the product says: “reading the last ninety days and suggesting from it, which is built and has not yet run on a real mailbox”.
• business-signup, the product says: “connecting a business's own mailboxes, which is built and has not yet read a real one”.
• backstop, the product says: “the backstop that holds a commitment nobody approved, which is built and tested against a fixture and has not yet stopped one on a real shop”.

Also not built: completing a payment, sending email to anybody other than the account holder, and the data deletion above. Deliberately not attempted: anything off the web, solving multi-factor prompts or captchas on somebody's behalf, taking over a live browser video stream, and running arbitrary code — the graph is a bounded set of steps with one route taken at a time, because there is no sandbox to run arbitrary code in.

It is not a certification. Nothing here has been audited by anybody outside this project, there is no SOC 2 report, no penetration test and no compliance programme. What there is: the controls described above, tests that exercise them, and a product that says out loud where each one stops.

If you are evaluating this for a company, the honest summary is that the controls are real and the assurance around them is not yet. Both of those sentences are worth knowing before you decide.