Skip to main content

Trust and Privacy

Workloom assumes AI workflow assets can carry real authority. A markdown instruction is not the same risk as a hook, MCP server, tool permission, or sandbox setting.

Current Gates​

  • Executable hook assets are denied before writes.
  • Committed Copilot projections require explicit local approval.
  • Telemetry fixtures with raw prompts, raw outputs, file content, exact paths, tokens, usernames, emails, or diffs are rejected.
  • Manifest paths reject absolute paths, traversal, backslashes, and case collisions.

Planned Gates​

  • MCP server identity and secret-reference policy.
  • Tool permission wildcard denial.
  • Sandbox and approval weakening detection.
  • Unknown provider setting review.
  • Interactive local approval and later org-wide approval workflow.
  • Ownership-aware restore that refuses to overwrite unknown files.

Privacy Posture​

Telemetry and debug bundles should contain operational metadata only: command names, provider IDs, versions, result categories, durations, anonymous hashes, and failure classes. They must not contain prompts, source code, local exact paths, tokens, secrets, diffs, or identity fields.