Secrets, policy and audit stay host-side.
Host-side control
Everything sensitive stays on the host.
- Provider API keys and integration secrets stay on the host
- Secrets encrypted at rest, gated by a master key
- Host GUI uses session auth and CSRF protection for browser mutations
- Orchestration, policy decisions, tool attachment and audit logging all happen host-side
Sandboxed execution
Capability runs are boxed in.
- Capability runs are constrained per invocation
- Filesystem access restricted to explicit read, write and exec paths
no_new_privs, non-dumpable process state, seccomp filtering, Landlock restrictions, resource limits- One process per invocation
Controlled egress
One path out, and you rule it.
- All guest network traffic routes through a host-controlled proxy
- Domain rules support default-allow or default-block
host.internalexposes only the routes you permit- Capability invocations receive temporary scoped credentials
Inbound and outbound firewalls
Read the log. Set the policy.
Configurable LLM safety evaluation on both directions of an ingress agent, with policy prompts, refusal messaging and audit logs. Choose the evaluator; set the policy; read the log.
What this gives your compliance team
Data lineage without a documentation project.
What entered the prompt, what was retrieved, what the model returned, which tools ran, what it cost — recorded as a by-product of operation.
Article 50 transparency duties take effect 2 August 2026. Annex III high-risk obligations now run to December 2027, which means you are building an architecture rather than buying a patch.
