How authorization works

Local device scope

The device owner exposes no folders, selected folders, the home directory or the full filesystem.

Cloud device policy

Account owners can narrow folders, make them read-only and disable execution for every Agent.

Agent authorization

Agent access selects devices, folders and tools. Existing connections always use the latest saved settings.

Approval policy

Approvals are independent from capability. They can apply to writes, execution or every device operation.

Resource model

Account

The ownership boundary for users, devices, authorizations, connections and history.

Device

A paired Connector identity with live capabilities and a cloud-side policy.

Agent access

A revocable grant defining which devices, folders and tools one Agent may use.

Connection

A scoped CLI credential or OAuth binding attached to one Agent authorization.

Invocation

A typed request with a target, deadline and stable idempotency identity.

Receipt

The durable device-side evidence used to reconcile retries and final state.

Changes and revocation

Saved policy changes apply to new work immediately and are checked again during ACK and lease renewal. Revoking an Agent invalidates its credentials and OAuth bindings. Removing device scope can cancel affected running work.