Security

OS-level sandbox, a credential service, and trust rules. Sensitive actions ask first.

Sandbox

Linux uses bwrap (bubblewrap). macOS uses sandbox-exec. Fail-closed: if the sandbox cannot start, the command fails. It does not fall back to unsandboxed execution.

• Workspace tools (file_read, file_write, bash) stay under the assistant workspace.
• Host tools (host_bash, host_file_*) run on the machine after you grant host access. Hatch is not a silent full-disk grant.

Credentials

Keys live in CES. The assistant does not keep API keys in the workspace. Prompt via the credential UI or assistant credentials prompt. Do not paste secrets into chat.

Trust rules

You can write a rule so a repeated action stops asking. That is explicit. See The permissions model and Security best practices.

Public ingress

Webhooks belong on the gateway, not on a raw assistant port. Do not expose the local runtime without auth.