Safety model

Agent Zero is built so that the safe path is the default path and every escalation is explicit, auditable, and reversible.

Observe by default

observe is the default mode and never writes to a target repository. A fresh deployment, an unconfigured repository, or a webhook from an unknown source can only ever produce a report.

Regardless of provider, a webhook can never escalate a run: parsed events produce observe-mode input unless the deployment's own policy chooses otherwise, and an unverifiable delivery is rejected before its payload is parsed.

The authorization chain for writes

Automatic changes require all of the following:

1. mode: fix or mode: autonomous in repository policy;
2. autofix.enabled: true;
3. model confidence at or above autofix.minConfidence;
4. a change-risk class listed in autofix.allowedChangeRisks — high-impact changes always require human approval and cannot be allow-listed;
5. repository-native checks that pass after the change;
6. by default for proactive, issue, or autonomous work: an isolated runner (autofix.requireIsolated).

Each refusal in this chain is a distinct reportable outcome rather than a silent downgrade, and a failed verification is never presented as success.

Untrusted input

Review feedback, model output, issue text, and remote content are all untrusted input — data for the runtime to validate, never instructions. Validation decides the verdict from repository evidence, not from anyone's assertion.

One execution boundary

Only packages/runner may invoke shell commands or mutate a checkout. Commands run without a shell, so operators such as &&, |, ;, and $() are rejected. Working directories, arguments, timeouts, and output limits are validated at the boundary. See Execution boundary.

Secrets

• Credentials are read only from fixed, documented environment variables — never from repository configuration.
• Endpoint URLs cannot be named in .agent-zero.yml; a custom endpoint can only come from the operator-owned AGENT_ZERO_MODEL_BASE_URL.
• Task records are redacted before they are written and never contain review input or checkout paths.
• Provider credentials never enter a sandbox request, lease snapshot, agent state, or log.

Production isolation

The included LocalRunner is intended for trusted local development. Production deployments must place execution inside Docker, a microVM, or another ephemeral sandbox with CPU, memory, filesystem, and network policies — set runner.isolation: container in repository policy.

Reporting vulnerabilities

Report vulnerabilities privately as described in SECURITY.md. Do not open a public issue.