Isolation & human control
Design boundaries that separate authority from the model.
Host and Agent Computer are distinct
The host contains local model services. The Ubuntu/XFCE/noVNC Docker environment is designed for file, browser and desktop tasks. The agent shell lives inside this environment; the host shell is a separate administration surface and excluded from the initial autonomous toolset. Only explicitly selected workspaces are mounted.
Limits of isolation
A container shares the host kernel; Docker provides neither absolute security nor VM-equivalent isolation. Host home, personal browser profiles, keys and Docker socket are not exposed. Narrow mount, network, process and permission boundaries are design requirements, not a runtime assurance implemented here.
Human control and approval
AGENT, HUMAN and PAUSED are distinct ownership states. Human takeover revokes the lease and invalidates queued inputs. Returning control requires a new observation and ownership lease. Approval is bound to a specific action, scope and expiry. Web pages, tool outputs and model text cannot expand permissions.
Local inference and network access
Model inference targets local execution; browser tasks may require the internet. Network access has a separate policy. Fully offline acceptance must be demonstrated independently using local fixtures with networking disabled.