Skip to main content
Agentick is two halves, and which half holds what is the whole security story. The cloud owns judgment and identity. Deciding that a ticket is actionable, what to ask the reporter, when to escalate, what the agent says and where it says it, what it cost. Your runner owns execution and secrets. A signed binary on a machine you own. Cloning, branching, editing, building, running tests, opening the pull request — and every credential involved in any of that.
This split is invisible from the outside, on purpose. A colleague’s laptop and their phone are both them. Which half of our system types a Slack message does not change who is speaking.

​
What that buys you

​
The connection is outbound, from you

Your runner dials us and holds the connection open. There is no inbound path from our network into yours, no port to open, no firewall exception to request, and no address of yours that we know. Work is leased to the runner over that connection; if the machine sleeps, the lease expires and the work is offered again.

​
We hold no repository credential

This is worth stating twice because it is unusual, and because the honest version has a cost. The agent’s git work is done by the coding tool already installed on your machine, authenticated with the gh login your engineers already use. We do not mint tokens. We do not install a GitHub App with repository contents access. We observe which pull request the agent opened; we do not open it. The cost, stated plainly: a cloud-minted, per-step, single-repository token would have been tighter security than a long-lived developer login sitting in a keychain, and revocation would have been in our hands rather than yours. We traded that for not duplicating a tool you already have, and for a credential story you can audit without trusting us. If your threat model prefers the other trade, say so — it is a real disagreement, not a misunderstanding.

​
Where the agent’s work is isolated

Steps run in a container on your hardware, with the agent’s own identity and its own credential volume, rather than as your login user. The boundary is a container specifically because it is the only one that exists on every platform we have to support. One caveat you should know about rather than find out: the executor is configurable, and the host executor remains the default on some configurations. See Known gaps.

​
Traces

Where run traces go is your choice at enrollment:
  • Our observability stack — the runner ships traces to us, redacted on your machine before they leave it, not filtered on arrival. By the time a filter on our side ran, the secret would already have crossed the wire.
  • Your own self-hosted instance — the runner ships full traces directly to your endpoint. We receive metadata only: step timings, states, outcomes, counts. Enough to render your dashboard and bill you; not enough to reconstruct your work.