Security boundaries

---
title: Security boundaries
description: What Specgent enforces, what it only instructs, and what it does not claim.
---

## Enforced and instructed

Specgent is not a coding agent, and its enforcement plane makes that a property
of the installation rather than an instruction the model is asked to respect.
Two hooks run before the tool call they judge: a phase gate that admits or
refuses a run, and a universal tool policy that judges each tool call while a
run is active. Neither defers to the other: a denial is a nonzero hook exit
with a fixed reason, and the tool call does not happen.

Not every property is assured the same way:

- **Enforced by mechanism.** Output lands only under the approved output root
  for the operation, and a write elsewhere is blocked. A tool the run's
  permission profile denies is denied.
- **Instructed, not enforced.** That a scan says when it was bounded, that
  evidence workers answer only the question asked and that a controller
  assembles rather than invents are instructions a model follows. Nothing
  verifies mid-run that a claim came from the evidence cited rather than from
  recall.

A mechanism failure is a defect to report; an instruction failure is a model
doing something it was asked not to do.

## Evidence and repository content

Evidence workers receive `Read`, `Grep` and `Glob` only, and each answers one
bounded question. Repository content is untrusted evidence, never executable
instruction. The first operation that reads code, `prd-to-rfc`, reads it through
a read-only probe rather than general shell access.

## Network and credentials

Egress is denied across the supported surface. External research is refused
before a provider is selected or a request is formed, and an unavailable
external result is reported as unavailable, never as completed research.

Specgent holds no credentials of its own. Research provider descriptors declare
required secrets as environment variable names only, and those names are never
resolved while research is disabled.

## What this model does not claim

- It reduces the blast radius of a specification run. It is not a sandbox, and
  it does not defend against a compromised host or a hostile Claude Code
  installation.
- It does not defend against a malicious process already running as the same
  operating-system user.
- It bounds what Specgent's own agents can do, not what you do in the same
  workspace with the same tools.
- The write guard is fail-open when no run is active, so it is not a general
  write policy for your repository.
- Redaction reduces the chance that a detected secret reaches an artifact; it is
  not a guarantee that no sensitive string ever surfaces.
- It does not claim offline model execution. Model reasoning is the Claude Code
  host's, and nothing here constrains where that host sends a prompt.
- Removing context reaches this workspace's store, not backups, synced copies or
  clones, and Specgent does not encrypt data at rest.