Data access and security
Updated: Facts checked:
Before deployment, check which account the agent uses, which files and services it can access, and who approves its results. Chat instructions alone do not restrict access. Technical protection comes from OS, repository and service permissions, plus any sandbox provided by the AI tool. Lazurio does not add a universal sandbox of its own.
Boundary map
Section titled “Boundary map”A trust boundary limits how far access or a compromised process can reach. Separate folders organize work, but do not by themselves stop a program with the same permissions from reading their contents.
Identity and session
Section titled “Identity and session”A task agent works for the signed-in principal and owns no separate rights. A prompt creates no repository or provider grant. At the same time, policy text cannot remove a capability already available to the process: a readable file, active session or exposed credential may be usable by the client.
Machine and Organization
Section titled “Machine and Organization”An Organization is one company’s GitHub and repository boundary. Company data, secrets and strategy must not cross into another Organization. One machine, however, is one trust domain. Directory and repository boundaries are not kernel or cryptographic isolation from another process with the same OS access. Use separate machines or equivalent infrastructure when a compromise must not cross company boundaries.
Personalspace
Section titled “Personalspace”Personalspace is private to one principal, not a shared company store. Company knowledge needed by colleagues belongs in an authorized Organization source of truth rather than another person’s private context.
External tools and secrets
Section titled “External tools and secrets”For a new connection, the integration standard prefers an official MCP server, then an official CLI, permitted Composio, a reviewed open-source implementation and finally supervised browser use. Executor manages custom MCP servers in Lazurio. For an existing connection, agents use the app’s tool, Executor or Composio according to its recorded route, in that order.
Composio is an approved broker only where the Organization or Personal Environment user permits it. Composio holds credentials and processes call content. Connected accounts belong to the Composio account and organization; do not assume that separate machines isolate them. Use team accounts in a Team Environment.
The standard excludes new ChatGPT or claude.ai connectors, other shared brokers, and scraping or browser-session servers. A provider-operated remote MCP can fit when its configuration and token remain separately revocable for the machine.
A workflow that writes may need read-and-write provider scopes. A draft stored at the provider can already transfer data. Check account scope, token custody and write restrictions in Connecting an Environment to apps. Real credentials stay outside Git in scoped ignored paths or approved provider stores. Endpoint, backup, rotation and incident controls must protect them.
Connect through the catalog
Section titled “Connect through the catalog”Open Apps → Integrations and the app’s card. You sign in there; the agent returns the card link and verifies the account afterwards. Custom MCP servers belong in Executor on your explicit instruction. A separate AI-client setup is not the current Lazurio route.
The approved ChatGPT-app policy is default-off inside an Environment, with Admin/user permission and only for gaps in the catalog. Its implementation is newer than v0.1.14; an older installation is not proof of technical enforcement. An existing connector on your own computer is a separate transition case. See the version and policy details.
Executor pauses certain calls, but in the default mode the agent resumes them. This is not a universal human-approval gate and does not cover every CLI or management API path. Integration controls explain the exact scope.
Use the Environment vault
Section titled “Use the Environment vault”For a supported configured Environment, use Apps → Vault. Agents use the Environment’s technical account, not your personal master account. The Organization vault for people is separate: give agents only the selected items copied into their Environment vault. Personal Environments connect a separate agent account in the user’s chosen Bitwarden service.
If an agent needs a secret, it can prepare a lazurio vault request. Enter
the value on the request page in Apps → Vault, not in chat or a tracked file.
A deployment without a configured vault needs its supported setup first;
the feature’s presence does not prove that any particular vault is connected.
Protect the endpoint, backups, rotation and the higher host-administration boundary.
Threats to test
Section titled “Threats to test”| Threat | Acceptance test |
|---|---|
| Access to another company | Confirm GitHub denial for an identity without the grant, then separately test the chosen client’s local filesystem boundary. |
| Unapproved publication | Attempt a protected merge or deployment without the required permission, check or review. |
| Credential copied into source | Read back the scanning actually enabled and run an approved safe-canary exercise in a test repository. |
| Over-broad integration | Inspect live scopes and revoke one credential without affecting unrelated access. |
| Prompt injection | Seed a harmless canary and confirm the agent neither expands scope nor publishes without the relevant gate. |
| Lost endpoint | Exercise device lockout, credential revocation, recovery and offboarding. |
| Documentation drift | Expire or change a source reference in a test branch and confirm validation fails. |
The documentation repository’s own checks include a narrow denylist for known private markers and local-path patterns. They are not general secret scanning, SAST or DLP for every Organization. Record the live controls rather than promoting one repository’s test into a product-wide claim.
Model and hosted-service boundaries
Section titled “Model and hosted-service boundaries”The agent client sends selected prompts, files and tool results to the model provider. Lazurio does not handle those model requests itself. The operator must name the client, provider, account tier, authentication, telemetry, retention and region where relevant. This site makes no universal training or retention claim across providers.
Dashboard, hosted team workspaces and per-owner Resident/Buddy services are optional or separately deployed. If enabled, each needs its own operator, identity, storage, network path, processor list, logs, retention, backup, deletion and incident controls. Source code being present does not prove that a service is active.
Audit and residual risk
Section titled “Audit and residual risk”Git records file changes, pull requests and approvals. Deployment records show which version went live. These records do not automatically cover local file reads, model requests or external API calls.
For each type of action, identify where the account, target and result are logged and how long the record is kept. Note any missing logs in the deployment review.
An authorized identity can still expose data or approve a harmful change. A model can follow malicious content. A machine can be compromised, and a Draft branch or provider draft may already move data before final publication. Lazurio narrows and exposes these decisions; it does not replace least privilege, endpoint security, provider review, testing or accountability. See the security and control evidence for the exact public-source basis of these claims.