Built so a leaked prompt can't become a leaked key.
Permaura treats the LLM as untrusted and puts enforcement where it belongs: at the capability boundary, server-side, audited.
Non-negotiable principles
The model never receives raw secrets
No API keys in tool responses. No tokens in prompts, logs, or shell history. If a workflow can't be done without exposing a secret to the model, the default is unsupported.
Deny by default
If no policy explicitly allows an action, it is denied. Access is granted by scoped, time-boxed grants, never inherited from whatever credentials live on the machine.
Separate intent from execution
The agent proposes or requests; Permaura executes. The capability boundary, not the prompt, is the security boundary. MCP is transport, not trust.
Audit everything
Who requested what, which agent, which device, which policy decided, which secret was used, what external action happened, and what a human approved: all answerable later.
Threat model
A summary of what Permaura defends against and how. The throughline: limit what the surrounding system can do, rather than trusting the model to behave.
| Threat | Mitigation |
|---|---|
| Prompt injection convinces the agent to act maliciously | The agent can only call capabilities. Policy is evaluated server-side, independent of the prompt. Out-of-scope or over-limit actions are denied with a reason. |
| Secret leaks into transcript, logs, or context | Secrets are injected only at execution time, server-side, and never returned to the model. Tool calls store a request_hash and summary, not the raw body. |
| A long-lived credential is over-permissioned | Grants are scoped to principal, resource, and action, expire automatically, and can be capped by max_calls and max_amount. Sessions revoke instantly. |
| An audit record is altered after the fact | Audit events are hash-chained (each row carries the previous row's hash) and ed25519-signed, so tampering breaks the chain and fails verification. |
| A high-value action runs without oversight | Critical actions require human approval every time: each request pauses until you approve it from your console, single-use and time-boxed. Device-signed approvals — a push to a paired phone that signs the exact request — are coming soon. Two-person approval is planned for Enterprise. |
| Hosted execution exposes a secret to the cloud | Local-only is the default. Remote execution is opt-in and honestly scoped: encrypted at rest, briefly decrypted in memory. BYOK and VPC workers are planned for Enterprise. |
Same-user is not a boundary
Where the gateway and the agents run as one operating system user, any process that user runs can read the operator token and call the API directly. A paired approver device bounds the damage rather than closing the gap: vault export, destructive changes and trust changes are held for a signature, so someone holding only the operator token can act within policy but cannot export the vault or turn the hold off. What makes the operating system enforce the line is running the gateway under its own identity, or keeping agents in a separate account or virtual machine. A container that mounts the owner’s home directory does not.
Account recovery is a trust choice
A gateway with remote access configured is an OAuth resource server for permaura.com, and that makes a permaura.com recovery ticket a third authority for the controls that loosen trust. It exists so an owner whose device and recovery codes are both gone can get back in. The cost is that such a gateway trusts the account and that ticket as part of its custody, because a compromised authorization server could assert the re-authentication itself. A gateway with no remote access has no such route, and no such trust.
Cryptography
Envelope encryption
A random per-secret DEK (AES-256-GCM / ChaCha20-Poly1305) encrypts each secret, wrapped by a vault KEK.
Key custody
A random vault key, kept in the macOS Keychain or Windows Credential Manager where the platform allows and in an owner-only file otherwise, with each secret's wrapping key derived from it by Argon2id. Hosted workers keep theirs in Secret Manager.
Signed, chained audit
Audit events are ed25519-signed and hash-chained for tamper evidence. Verification is a first-class operation in the console.
Minimal data at rest
Secrets split across ciphertext, wrapped DEK, and metadata. Tool calls keep request_hash + summaries, not full request or response bodies.
Let your agents do real work, without the keys.
Install the local gateway, connect Claude Code or Codex, and approve your first capability in minutes. Deny by default, audit everything.