Security model
Jeden treats model output as a proposal. Authority comes from the local runtime, its operator policy, and the exact state observed before an effect.
Defense layers
Capability exposure
Read tools are available by default. Write and command families require explicit invocation flags or configuration.
Workspace jail
Filesystem tools resolve paths beneath --cwd. Context imports remain within their context root.
Approval policy
always-ask, write, or yolo determines which allowed effects still require confirmation.
Lifecycle hooks
Pre-tool hooks can inspect, narrow, replace supported inputs, or block the call.
Revision guards
Digests and snapshot tags reject stale writes rather than overwriting concurrent changes.
Durable evidence
Requests, tool calls, decisions, results, usage, and artifacts remain attached to the session.
Approval modes
| always-ask | Prompt before any effect classified as approval-required. |
| write | Grant configured write behavior while retaining stronger boundaries for command execution. |
| yolo | Automatically approve exposed tools. Only safe inside an independently trusted sandbox. |
Model-bound secrets
Known secrets are protected before text reaches the model. secrets.mode selects redaction or obfuscation. Environment discovery protects secret-named variables at or above secrets.minLength.
Secret protection reduces accidental model exposure. Credentials should still come from the operator’s secret store and must not be committed to project configuration, context files, or transcripts.
Remote runtimes
jeden headless requires a server certificate, server private key, client CA, explicit identity map, and optional revoked-serial list. Mutual TLS authenticates the transport; the local tool policy still governs effects.