Part II · Compounding harness · 10
Security dials
Capability and safety trade off. Document who may reach tools and how approvals work.
20 min
Threat model
Security dials
Fail closed · least privilege
Edge
Allowlist
Who may talk
Approvals
Smart / manual
Core
Secrets out of chat
.env only
Least tool surface
Per profile
A private laptop is not a public bot. Choose capability deliberately. Gateway should fail closed: strangers never reach tools by default.
- Allowlist messaging gateway users (fail closed if unset).
- Approvals: manual | smart (default) | off, course uses smart or manual. YOLO is expert-only and still cannot bypass the hardline blocklist.
- Timeouts deny by default when you do not answer.
- Secret filtering: keep tokens out of prompts and MCP child environments where possible.
- Injection scans on SOUL / AGENTS.md / context files when enabled.
- Network: SSRF protections block private ranges; open only for a trusted local service you understand.
- Profile least privilege: research does not need a coder tool surface.
- Optional later: approval suggestions mine past decisions, they should never auto-apply destructive classes.
Keep defaults for this course. Disabling approvals for speed is how harnesses become liabilities. Checkpoints and rollback, if available, support recovery, they do not replace approvals.
Security guide ↗
Checkpoints & rollback ↗
Lab: key rotation →
Lab: failure studio →
Desktop check
Steps · tap to check0/4
Proof
Checklist · this device0/3
Proof of completion
You confirmed allowlist and approval mode (smart or manual), wrote security-dials.md with three settings and rationale, and did not enable YOLO for this course.
Proof · this device0/1
Stored on this device only, not sent anywhere.