Security model
Define what Jio isolates, which controls belong to the deployment, and where approval remains necessary.
Jio is designed around a simple assumption: an AI agent can propose incorrect or dangerous operations. The workspace should contain the consequences without granting the agent unnecessary authority.
Treat generated commands as untrusted input
A remote machine reduces the blast radius on your laptop. It does not make commands, dependencies, repositories, or downloaded scripts safe.
Control layers
| Layer | What to constrain | Practical default |
|---|---|---|
| Identity | User, group, and service privileges | Dedicated non-root identity |
| Filesystem | Read and write scope | One explicit workspace root |
| Processes | Command and child-process behavior | No host-level service control |
| Resources | CPU, memory, process count, and duration | Hard limits with timeouts |
| Network | Outbound destinations and listening ports | Deny by default, allow explicitly |
| Secrets | Credentials available to tools | Task-scoped, short-lived values |
Approval policy
Require explicit approval when an operation can materially change the workspace or reach outside it. Common examples include:
- installing a new package or running a lifecycle script;
- accessing a new network destination;
- writing outside the project tree;
- starting a long-running process;
- handling credentials or signing material;
- deleting a large or ambiguous target.
Low-risk reads and repeatable validation commands can usually run without interruption once the workspace boundary is proven.
Hardening checklist
- Run Jio and workspace processes without root privileges.
- Mount only the directories the task needs.
- Keep provider credentials and conversation history on the local side.
- Use allowlists for outbound network access when practical.
- Apply resource limits at the container, VM, or operating-system level.
- Capture tool requests, policy decisions, exit status, and timestamps.
- Rotate or destroy workspaces that have processed unfamiliar code.
- Test at least one denied operation after every policy change.
Residual risks
Isolation does not remove supply-chain attacks, malicious repositories, credential leakage within the workspace, or abuse of explicitly allowed network access. Choose the workspace lifecycle and credentials according to the code being handled—not only according to the agent being used.