Security model
Last updated 10 September 2026
How Ghillie keeps a capable agent from becoming a liability: leases, approvals, an unbroken audit chain, secrets that never leave the Keychain, and models that cannot widen their own reach.
Principles
- Constrain effects, not thought. Agents reason freely over the real goal and workspace. What they can change, send, spend, delete or remember is governed separately.
- Authority is explicit. Who may command Ghillie is an allowlist checked before any parsing, not a line in a prompt.
- Everything is recorded. Every model turn, tool call, approval, denial and policy change is an audit event in a hash-linked chain.
Capability leases
No task runs a tool directly. It receives a lease that names the allowed tools, the workspace scope, an expiry, a call budget and the approval policy in force. Every call is checked against the lease before it runs and written to the audit trail after. A model cannot request a wider lease than its task was granted, and a disabled Power cannot be leased at all.
Approvals
Outbound messages, spending and destructive operations are held until a person confirms the exact effect. See Approvals for what you see and where you answer.
Secrets
| Where | What is stored |
|---|---|
| macOS Keychain | The value itself, under one device-local service item. This is the only place plaintext ever exists. |
| PostgreSQL | The reference: label, provider, account, purpose, exact allowed tools, per-device binding state and value-free access events. |
| Memory and prompts | Nothing. Credentials never enter memory, prompts or audit text. |
Credential endpoints are loopback-only. A remote Core or a tailnet client cannot list, add, rotate, verify or revoke a credential, and there is no endpoint that returns a value. Access requires the reference to be active, the purpose to match exactly, the calling tool to be on the allowlist and a local binding to exist on this Mac. Wildcards are unsupported on purpose.
Local models for private work
Work you mark private can be forced onto models running on your Mac through Ollama. Extraction and classification then never leave the machine. Voice notes are transcribed locally as well; only the transcript and its hash enter memory.
Channels are transports
Telegram and Teams carry messages. They do not own conversations, Powers, memory or approvals. In Teams, words from anyone outside the allowlist can reach the model only inside a bounded block marked as untrusted source material, and Ghillie never takes meeting notes unless asked with transcription visibly running.
Health without leakage
Power health reports fixed, content-free status codes. A successful check covers the specific action and inputs used, activation alone never counts, and evidence older than 24 hours needs a retest. Messages, notes and credentials are never health text.