Security · The family

Safety model, in short

• Each Lock but lockhttp sits on an internal network, behind an egress allowlist: only the endpoints of its reviewed profile, no internet, cloud metadata or other host port.
• The hub never runs a request, never sees its results and never sees a value in clear. No agent reaches the hub.
• The console is the enforcement point; skills and tool descriptions only guide the agent. Masking is best effort.
• Chat facades (Slack, Telegram) never answer production tickets.
• Each Lock documents what the agent can see and its residual risks in its own docs/security-model.md.