Safety is enforced before the tool runs.
These are the controls that ship today — not aspirations, certifications, or third-party attestations. Every claim below names a control that already runs on the governed path.
Deny-wins policy before every tool call
The deny-wins policy cascade resolves workspace, lane, pack, and task rules before a tool call fires. Any deny at any tier wins; a narrower scope cannot re-widen a denial set higher in the cascade.
Fail-closed budgets
Workspace and session spend and token budgets are checked before work is claimed. When a budget is exhausted or unavailable, the run fails closed — it does not continue under an open-ended envelope.
Execution sandbox
Agent tool execution runs inside an operating-system sandbox that confines file writes and denies reach into host resources outside what a tool call was granted.
Honest-scope receipts
Every governed action records the requested, allowed, and enforced scope triple on a content-addressed receipt, so evidence cannot overstate what was permitted versus what actually ran.
Recomputable evidence chain
Receipts are hash-chained and independently recomputable. Anyone with the sealed record can verify the chain was not altered after it was written.
Untrusted-input boundary
Connector and tool results, plus pasted transcripts and briefs, are treated as untrusted input. Instructional content in those surfaces is wrapped so it can plant text but never become an instruction the model treats as authoritative; consequential actions after an untrusted read still require approval.
Back to Security · Vulnerability disclosure