Security
How the system constrains what the AI can do.
Authority is bounded
Authority lives in exactly three places: local tool authority in Directioner-CLI, cloud action authority in the backend, and privileged machine authority in Directioner-OS.
A repository, a tool result or a model response can inform a decision. None of them can authorise an action. Text is never authority.
Capabilities, not shell
Every action the AI takes is a typed, versioned capability such as package.install or service.restart. Tokens are short-lived, plan-scoped and revocable. The AI control plane never shells out to root commands.
The capability model is enforced alongside kernel and LSM controls, as a second, independent line.
Approval gates
Each step is scored for blast radius and routed to auto-allow, notify-after, confirm-before or expert-review. Changes to authentication, networking or privilege require a security review before they can reach a lower gate.
A single kill switch revokes every capability token and halts background activity, independent of whether the AI control plane is responsive.
Audit and recovery
There is an immutable, append-only audit log and a signed do-not-touch list. Snapshots and boot-slot rollback make risky changes reversible.
Honest limits
We do not claim the system is unhackable, or that nothing can go wrong. It is designed for detection, constrained failure, safe recovery and truthful status.
Common questions
Can the AI act on its own?
Only within the capabilities it was granted, and only through the approval gate that matches the blast radius of the step. A model response can propose; it cannot authorise.
What stops prompt injection?
Text is never treated as authority. A file, a web page or a tool result can inform a decision, but the decision is checked against the policy layer and enforced independently of the model, so injected instructions cannot exceed the granted capabilities.
What does the kill switch do?
It revokes every capability token and halts background activity. It works whether or not the AI control plane is responsive, because it does not depend on the control plane to take effect.
Is there an audit trail?
Yes. Every capability call is written to an immutable, append-only log, alongside a signed do-not-touch list. Snapshots and boot-slot rollback make risky changes reversible.
How are accounts protected?
Passwords are stored as scrypt hashes and compared in constant time. Sessions are signed cookies that can be revoked, a second factor is available, and the authentication endpoints are rate limited. Changing a password ends every other session.
Reporting
Report a vulnerability to support@adityamunday.codes.