Part II · Compounding harness · 10
Security dials
Capability and safety trade off. Document who may reach tools and how approvals work.
20 min
Security dials
Fail closed · least privilege
Edge
Allowlist
Who may talk
Approvals
Smart / manual
Core
Secrets out of chat
.env only
Least tool surface
Per profile
Threat model
A private laptop is not a public bot. Choose capability deliberately. Gateway should fail closed: strangers never reach tools by default.
- ·Allowlist messaging gateway users (fail closed if unset).
- ·Approvals: manual | smart (default) | off — course uses smart or manual. YOLO is expert-only and still cannot bypass the hardline blocklist.
- ·Timeouts deny by default when you do not answer.
- ·Secret filtering: keep tokens out of prompts and MCP child environments where possible.
- ·Injection scans on SOUL / AGENTS.md / context files when enabled.
- ·Network: SSRF protections block private ranges; open only for a trusted local service you understand.
- ·Profile least privilege: research does not need a coder tool surface.
- ·Optional later: approval suggestions mine past decisions — they should never auto-apply destructive classes.
Keep defaults for this course. Disabling approvals for speed is how harnesses become liabilities. Checkpoints and rollback, if available, support recovery — they do not replace approvals.
Desktop check
Steps · tap to check0/4
Proof
Checklist · this device0/3
Proof of completion
You confirmed allowlist and approval mode (smart or manual), wrote security-dials.md with three settings and rationale, and did not enable YOLO for this course.
Proof · this device0/1
Stored on this device only — not sent anywhere.