Security model

Invariants

• The tool map is the boundary. The agent exposes a fixed set of named tools with typed, validated inputs; arguments go to the operating system as arguments, never into a shell string; there is no generic execute path.
• Shell is local policy. allow_shell lives in the machine's own configuration; the hub cannot set it.
• Only signed binaries. Updates verify an Ed25519 signature made by an offline key before the swap; the hub chooses versions, never code.
• Tiering lives in the hub. Read tools run automatically; every mutating tool is behind a proposal and a named approval; new mutating tools default to approval.
• Company scope on every request. Machines belong to the company that enrolled them; another company's token cannot claim one; out-of-scope answers are 404.
• Machine output is untrusted. Logs, process names and paths are data; containment is the allow-list and tiering, not string sanitising.

Agent

• outbound HTTPS only, no listening port; optional certificate pinning
• command output capped at 256 KB; timeouts on everything; process groups killed on timeout
• checks are data validated on the machine
• static binary, no runtime, no package dependencies

Hub

• passwords as salted scrypt hashes; HttpOnly SameSite=Strict sessions; lockout after five failures
• API keys and enrollment tokens stored hashed; enrollment tokens also kept in clear because install pages must embed them, which is why they rotate
• three roles; every handler filters by company
• append-only audit trail of calls, results, approvals, sign-ins, rotations

Not guaranteed

The investigator's judgement (that is why it cannot act); the people you give approval rights to; and, if the hub is hosted for you, our operations. See the security page for the plain-language version.