Trust model: mechanisms instead of badges
Trust in this project is built not on badges and declarations, but on three verifiable mechanisms that are visible in the interface and in the launch journal.
- Least privilege. Every source and tool is connected separately.
- Explicit consent. The consequence of a sensitive action is explained before confirmation.
- Launch trace. Version, inputs, stages and decisions form a readable journal.
Each mechanism is checked against the journal: you can see which sources are connected, which actions the human confirmed and how the permissions changed.
Four levels: data, access, execution, result
Security is designed at every level, and the actual measures must be confirmed by tests, documentation and the contract.
- Data. Classification, minimization, deletion and retention periods.
- Access. Roles, separate permissions, session revocation and audit of changes.
- Execution. Task isolation, tool limits and safe error handling.
- Result. Traceability, labeling of synthetic content and export control.
Promise and direction: the status of the measures
We deliberately do not attribute the properties of a mature production platform to the demo. For each area the status is described twice: what the demo version does and what a production deployment requires.
| Area | Demo version | Production deployment requirement |
|---|---|---|
| Form submission | Not submitted | Secure transport and a confirmed recipient |
| Authentication | Mock only | Secure sessions, MFA as required, access revocation |
| Storage | Real data is not accepted | Retention, deletion, backup and location are fixed |
| Certification | Not claimed | Only after independent confirmation |
What to verify before launch
Verifiability is a launch condition, not a bonus. Four questions about data and access that must be answered before the first launch.
- What data does the agent receive? Only the sources and fields listed before launch; access to any other data is not implied.
- Can the materials be deleted? A production deployment provides deletion and a retention policy; the period is fixed in the chosen environment and the contract.
- Is there an action log? A journal of stages, sources used, decisions and permission changes.
- Is data shared with third parties? The list of processors and services is disclosed before a production deployment; the demo version sends no user data.
Where the boundaries are fixed
Security measures do not end on this page: the privacy policy and the terms fix data processing, the local deployment with no external integrations can eliminate third-party data transfer, and the agent work journal makes the launch progress readable.
Questions and answers
What data does the agent receive?
Only the sources and fields listed before launch. Access to other data must not be implied by the interface.
Can the materials be deleted?
A production deployment must provide deletion and a retention policy. The exact retention period is fixed in the chosen environment and the contract.
Is there an action log?
The project provides a journal of stages, sources used, decisions and permission changes.
Is data shared with third parties?
The list of processors and services must be disclosed before a production deployment. The demo version sends no user data.
What is least privilege?
Every source and tool is connected separately; access to data outside the declared task is not implied.
How does explicit consent work?
The consequence of a sensitive action is explained before confirmation; the action runs only after explicit human consent.
What happens to data in the demo version?
Forms are not submitted, real data is not accepted, and user data is not shared with third parties.
Does the project have certification?
The demo version makes no certification claims. A production deployment can claim certification only after independent verification.
What goes into the launch journal?
Version, inputs, stages, sources used, decisions and permission changes.
Where are the security measures fixed?
Measures are confirmed by tests, documentation and the contract; the processing environment and retention periods are fixed before launch.