Security and approvals
Resolve authority before execution with deny-by-default capabilities and human approval gates.
Authority is resolved before execution
Capability policy
Skill manifests declare the authority they need. Policy compares each request with explicit grants; undeclared or ungranted access is denied rather than inferred.
Human control
Destructive or externally visible actions enter the approval queue. Safe mode can suspend risky capabilities and narrow the system to controlled operations.
Attestation and secrets
Ed25519 attestations identify the request, approval, and worker involved in sensitive work. Secrets use AES-256-GCM encryption at rest and should never be copied into prompts or logs.
Worker quarantine
Worker health reports include the expected ledger head, build checksum, and configuration version. A mismatch records a `worker.quarantined` privileged ledger event and makes the worker ineligible for new assignments until the cause is corrected.
API authentication
Protected operations require the configured bearer-token boundary. Capability grants can be listed, created, and revoked; approval decisions are separate records so authentication never silently implies authority.