Trust Model

Workloom manages files that influence AI agent behavior. Some of these files can expand permissions, execute commands, or connect to external services. The trust model classifies assets by risk level and gates writes accordingly.

Risk classification

Category	Examples	Risk	Default behavior
Passive text	Instructions, prompts, markdown	Low	Render freely
Configuration	Provider settings, model preferences	Medium	Render with review
Authority expansion	Tool permissions, sandbox changes	High	Block until approved
Executable	Hooks, commands, scripts	High	Block by default
Network-bearing	MCP servers, configs with URLs/tokens	High	Block unless approved
Committed projection	Files committed to repo (Copilot)	Medium	Requires projection policy

Blocking rules

These assets are never written without explicit approval:

• Hooks that execute shell commands
• MCP server configurations
• Tool permission expansions (e.g., adding dangerouslyAllowBrowser)
• Sandbox weakening
• Inline secrets or tokens

Approval ledger

Local approvals are recorded in .loom/state.json:

{
  "approvals": [
    {
      "package": "@acme/copilot-baseline",
      "version": "1.0.0",
      "provider": "copilot",
      "surface": "committed_projection",
      "path": ".github/copilot-instructions.md",
      "contentHash": "sha256:...",
      "approvedAt": "2026-05-11T00:00:00Z",
      "approvedBy": "local-user",
      "approvalType": "phase1-local"
    }
  ]
}

Phase 1 approvals are local only. They do not imply org-wide approval.

Policy enforcement

Workspaces can define policies that restrict what packages can do:

• Deny hooks — no package may install hooks in this workspace
• Deny MCP — no package may configure MCP servers
• Require review — all committed projections require manual review
• Pin providers — only allow rendering for specified providers

CI enforcement

wl sync --check verifies policy compliance as part of drift detection. A workspace with a policy-denied hook that somehow exists locally will cause a non-zero exit.

Privacy guarantees

Workloom's trust model extends to telemetry and debug output:

• Telemetry never includes source code, raw prompts, raw outputs, exact paths, usernames, or tokens
• Debug bundles are redacted before collection
• Anonymous IDs by default, with admin opt-out controls