Security model

Brainwrite is designed around a local owner, explicit capabilities, and narrow process boundaries. Local-first does not mean risk-free: an agent with tool or computer access can still act on the resources you grant it.

Core boundaries

• The harness owns agent processes and listens on loopback.
• The renderer receives configured-or-not credential state, not secret values.
• Provider-specific credentials are injected only into the process that needs them.
• Bots start at Full access: each engine runs in its own most permissive mode. Choose Ask for approval on a bot or thread to turn risky actions into approval cards. Real questions and missing credentials always come to you.
• At Full access, emails, messages, posts, invites and payments a bot sends through connected apps go out without asking. Below Full access, each send asks first or counts against the bot's daily allowance. See Sending on your behalf.
• Local computer control is a separate opt-in and per-bot selection.
• Paired phones use a default-deny API allowlist and per-device bearer tokens.
• Cloud and VPS backends are validated before reuse.

Your responsibility

• Review approvals, especially shell commands, file writes, and actions in connected services.
• Use dedicated environments for untrusted or destructive work.
• Keep provider accounts and connected apps scoped to what a bot needs.
• Revoke lost companion devices immediately.
• Keep Brainwrite and agent CLIs updated.

Security reports should be filed through the repository's documented security channel rather than disclosed in a public issue before a fix is available.