> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentick.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Where things run

> The split between the cloud that decides and the machine that executes.

Agentick is two halves, and which half holds what is the whole security story.

**The cloud owns judgment and identity.** Deciding that a ticket is actionable,
what to ask the reporter, when to escalate, what the agent says and where it
says it, what it cost.

**Your runner owns execution and secrets.** A signed binary on a machine you
own. Cloning, branching, editing, building, running tests, opening the pull
request — and every credential involved in any of that.

<Note>
  This split is invisible from the outside, on purpose. A colleague's laptop and
  their phone are both them. Which half of our system types a Slack message does
  not change who is speaking.
</Note>

## What that buys you

|                                                 | Where it lives                        | Consequence                                                    |
| ----------------------------------------------- | ------------------------------------- | -------------------------------------------------------------- |
| Your source code                                | Your machine only                     | It is not on our disks, so it cannot leak from them            |
| Your repository credential                      | Your machine only                     | We hold none at all — see below                                |
| Your runtime login (Claude Code, Cursor, Codex) | Your machine only                     | Your subscription, your auth, never proxied through us         |
| Model spend for the work                        | Your key, egressing from your machine | Prompts containing your source never transit us                |
| Case state, decisions, timings                  | Our cloud                             | This is the product                                            |
| Your network access                             | Your machine's                        | We reach nothing of yours; the connection is outbound from you |

## The connection is outbound, from you

Your runner dials us and holds the connection open. There is no inbound path
from our network into yours, no port to open, no firewall exception to request,
and no address of yours that we know. Work is leased to the runner over that
connection; if the machine sleeps, the lease expires and the work is offered
again.

## We hold no repository credential

This is worth stating twice because it is unusual, and because the honest
version has a cost.

The agent's git work is done by the coding tool already installed on your
machine, authenticated with the `gh` login your engineers already use. We do not
mint tokens. We do not install a GitHub App with repository contents access. We
observe which pull request the agent opened; we do not open it.

**The cost, stated plainly:** a cloud-minted, per-step, single-repository token
would have been *tighter* security than a long-lived developer login sitting in
a keychain, and revocation would have been in our hands rather than yours. We
traded that for not duplicating a tool you already have, and for a credential
story you can audit without trusting us. If your threat model prefers the other
trade, say so — it is a real disagreement, not a misunderstanding.

## Where the agent's work is isolated

Steps run in a container on your hardware, with the agent's own identity and its
own credential volume, rather than as your login user. The boundary is a
container specifically because it is the only one that exists on every platform
we have to support.

One caveat you should know about rather than find out: the executor is
configurable, and the host executor remains the default on some configurations.
See [Known gaps](/trust/known-gaps).

## Traces

Where run traces go is your choice at enrollment:

* **Our observability stack** — the runner ships traces to us, redacted *on your
  machine before they leave it*, not filtered on arrival. By the time a filter
  on our side ran, the secret would already have crossed the wire.
* **Your own self-hosted instance** — the runner ships full traces directly to
  your endpoint. We receive metadata only: step timings, states, outcomes,
  counts. Enough to render your dashboard and bill you; not enough to
  reconstruct your work.