Documentation

Current limitations

What is not built, stated before you depend on it.

Not implemented

• No runtime sandbox, process allowlist, or network egress allowlist. Repository operations do not run in an ephemeral, resource-limited, network-restricted worker.
• No automated production deployment, and no rollback loop.
• No transparency-log anchoring or trusted timestamping.
• No raw prompt or response transcript store. Token counts and per-call cost are metered; the text is not retained.
• No SSO, SAML, or OIDC. The membership model distinguishes only membership from non-membership.
• No structured log of every command executed, as a general control.

Weaker than it sounds

Signing-key custody is a configuration boundary, not a credential boundary: the correct statement is that the agent process does not currently hold the approval-side credential, never that it cannot obtain it. The connector’s repository permissions are not minimal. The approver identity attached to an approval is a supplied string, not a bound identity.

The full account, with the evidence behind each control that does hold, is on the security model page.