Control belongs outside the agent.

One way out.

Workers run in isolated workbenches. External requests pass through the Gate, which applies policy, adds credentials and keeps a ledger. The design gives the agent no separate route to the internet.

Credentials stay with the Gate.

API keys, tokens and website sessions belong to the Gate. Workbenches see placeholders. For website sign-ins, you use a hand-off browser; passwords and sessions are not handed to the agent.

Approve the request that will run.

Consequential writes wait for approval unless your policy already allows them. The approval describes the exact request. Approved work is designed to be sent once and recorded with a receipt. If the Gate or ledger is unhealthy, writes fail closed.

Keep spending bounded.

The Gate reserves model-call costs against daily and monthly caps before the call leaves. An unpriced model call is refused until pricing is configured. Your selected providers and services still have their own billing terms.

Files you control.

Memory, personas and skills live in a git vault. You can read its Markdown files and inspect changes. Keep backups, protect your host account and review what connected services can access.

Where the protection ends.

• Models can be wrong. Prompt injection and misleading content remain risks.
• Policies and approvals reduce unwanted effects; they do not make an approved action harmless.
• A compromised host, compromised provider or mistaken owner approval can still cause harm.
• Hosted model providers receive the data sent in their requests. Self-hosting does not mean every operation stays local.
• Account-security and payment rules are maintained per service. They cannot cover every possible way to move money.
• Isolation differs by host. The macOS and Windows targets do not provide the same host gVisor layer as Linux.

See the release status and host requirements.