SDK access
Modules call SDK methods for database, media, UI, tasks, AI, and knowledge rather than importing private runtime code.
Security
Security starts with boundaries that extension code must use.
The runtime is designed so modules, engines, and extractors work through public contracts. Permission checks, scoped models, quotas, audit events, and process policy are platform concerns.
Application boundary
A module should not need private runtime access.
The safest extension model is one where the supported path is also the easiest path.
Permissions
Actions and pages declare access requirements and run with the authenticated user and organization context.
Scoped models
Module models inherit base behavior that applies user and organization filters where configured.
Runtime policy
Sandbox policy follows every extension path.
A Python-level Process Guard mediates extension behavior across platforms. OS-specific enforcement then applies the strongest available boundary for the host: Linux kernel controls, macOS Seatbelt, and Windows enforcement paths.
Process Guard (Python)
A default-on, portable layer that mediates which modules extension code may import and which network targets and files it may reach.
Linux enforcement
Landlock confines filesystem access, seccomp-BPF blocks escalation syscalls, and cgroup/iptables rules can enforce network egress when host privileges are available.
macOS and Windows paths
macOS uses Seatbelt profiles. Windows work uses low-integrity and WFP-based enforcement paths, with server-mode handling for hosted deployments.
Network egress and approvals
External access is policy-gated in one place. Allowed targets can come from manifests, runtime approvals, or infrastructure configuration.
OS enforcement varies by host capability. When a host-specific kernel or platform layer cannot be applied, the SDK boundary, Process Guard, approval checks, and audit trail still define the runtime policy.
Practical security
Security claims should map to visible controls.
The goal is not to promise invisible guarantees. The goal is to expose boundaries, checks, and audit evidence.
Import boundaries
Extension code should depend on public SDK modules instead of core implementation paths.
Approval and quota points
Actions, tools, and engine calls can cross explicit policy gates, including external access approvals and token/request limits.
Inspectable failures
Policy failures should be visible as runtime errors and audit events rather than silent behavior.
Next
Related pages
Use these pages to move from the concept to adjacent parts of the runtime.