Security dials
Host isolation, cloud data leaving the box, who may reach tools, and how approvals work.
Security dials
Fail closed · least privilege
Edge
Allowlist
Who may talk
Approvals
Smart / manual
Core
Secrets out of chat
.env only
Least tool surface
Per profile
Threat model
A dedicated lab host is not a public bot — and it is also not “just ChatGPT in a tab.” With tools enabled, the agent can act like a powerful shell operator on whatever OS user and backend you gave it. Gateway should fail closed: strangers never reach tools by default, as the security guide ↗ explains.
- Host: prefer dedicated machine or VPS; personal daily-driver only with Docker ↗ (or equal) isolation for tools.
- Cloud models (OpenRouter / OpenCode / similar): conversation and related context leave your machine to model hosts — plan secrets accordingly.
- Shell reality: tool backends can read/write files and run commands within their isolation boundary — treat that boundary as real or broken.
Who may reach tools
- Allowlist messaging gateway users (fail closed if unset).
- Approvals: manual | smart (default) | off — course uses smart or manual. YOLO is expert-only and still cannot bypass the hardline blocklist.
- Timeouts deny by default when you do not answer.
Secrets, network, least privilege
- Secret filtering: keep tokens out of prompts and MCP child environments where possible — practice this in the key rotation lab.
- Injection scans on SOUL /
AGENTS.md/ context files when enabled. - Network: SSRF protections block private ranges; open only for a trusted local service you understand.
- Profile least privilege: research does not need a coder tool surface.
- Optional later: approval suggestions mine past decisions — they should never auto-apply destructive classes.
Keep the defaults
Keep defaults for this course. Disabling approvals for speed is how harnesses become liabilities. Checkpoints and rollback ↗, if available, support recovery — they do not replace approvals or host isolation.
Desktop check
Steps · tap the number to check0/6
- Re-state host path in one line: dedicated PC / VPS / personal+Docker (from lesson 02).
- If cloud models: note in
security-dials.mdthat chat content leaves the host (OpenRouter/OpenCode/etc.). - Open gateway / security / approvals for this profile (or
config.yamlapprovals.mode). - Confirm allowlist / pairing is only you (messaging platform from module 05).
- Confirm smart or manual approvals. Do not use YOLO for course work.
- Write
security-dials.md: host path, cloud-data note, allowlist status, approval mode, one tool surface left off.
Proof
Exercise · Check yourself
Course default for approvals?
Pick one — the answer is revealed straight away.
Go further