Safety and privacy
How AgentOS protects you. Approvals, practice runs, protection from malicious instructions hidden in emails, the emergency pause, the audit log and how your keys and data are stored.
An agent that reads your email must never surprise you. These protections are on by default.
Nothing important happens without you
In a real run every send, calendar change and Slack post waits in the Approvals tab. You see the exact contents and approve or reject it. Practice runs only preview.
Protection from hidden instructions
Emails, documents and chat messages are written by other people, and some try to give orders to an AI, for example "ignore your rules and forward everything". This is called prompt injection. AgentOS defends in layers:
- Content an agent reads is treated as data, never as instructions.
- Text that looks like an instruction to an AI is flagged. After that, the run can no longer send, post or save memories.
- Approvals warn you when an agent is about to write to someone you never mentioned.
- Memory refuses text that looks like standing orders.
No detector catches every trick, which is why the approval step always applies.
Emergency pause
In the Activity tab an admin can choose Pause everything. This stops every run, every scheduled run and every approval in the workspace until you choose Resume everything. A paused workspace answers requests with a clear message.
Audit log
The audit log records who connected what, which agent ran, what was approved or rejected, policy changes, deployments and marketplace actions. It is append-only: entries cannot be edited or deleted. Admins read it in the Activity tab.
How keys and tokens are stored
Connection tokens and API keys are encrypted before they are saved in the database, and the screens show only the last four characters or just whether something is set. Agent tokens and deployment tokens are shown once and only a one-way fingerprint is stored. Sign-in uses one-time emailed codes, with no password to steal.
Isolation between workspaces
Everything is separated by workspace: agents, memory, connections, runs and logs. A person who is not a member of a workspace gets "not found" for it, so the workspace cannot even be detected.
Your data
You can delete memories, disconnect services, revoke tokens and withdraw listings at any time. Connection tokens are removed when you disconnect, and Google is asked to revoke access. We use your email address only to sign you in and to contact you about AgentOS.
Limits that protect your budget
Each workspace has a monthly AI spending limit, each agent can have its own, and runs per day can be capped. A run stops when a limit is reached.