ARCANA
Back to Blog

Security

Trust Boundaries: Arcana's Security Model Explained

Jun 18, 2026 Security

An AI agent with file access and network permissions is a powerful thing. Arcana's security model is built on explicit trust boundaries: clear lines between what the agent can do freely, what requires approval, and what is forbidden.

The fundamental challenge with AI agents is that they are autonomous by nature. They make decisions, take actions, and modify your environment. Without explicit boundaries, the agent operates on trust that is implicit, unauditable, and inconsistent. One session might edit freely; the next might ask for permission on every file read. There is no systematic control.

Arcana's trust model replaces implicit trust with explicit, configurable boundaries. You define where the lines are. The agent respects them. Every action that crosses a boundary is logged, auditable, and reversible. This is not about limiting the agent's capability; it is about making the agent's capability predictable.

The Trust Zones

Arcana defines four trust zones:

  1. Agent context. The agent's own reasoning and conversation history. Always trusted, never gated.
  2. Workspace. Your project files. The agent can read freely but writes go through the file-edit guard. Trust is calibrated via workspace trust configuration.
  3. Network. External requests (API calls, web fetches, MCP communication). Gated by permission policy. Some requests are auto-allowed, others require approval.
  4. External services. Provider APIs, browser automation, and third-party integrations. Always gated. The agent must ask before making irreversible external actions.

Workspace Trust

Arcana evaluates workspace trust based on project structure, git history, and configuration. A well-established project with tests and CI gets higher trust than an empty directory. You can adjust this manually:

# Check current trust level
arcana trust status

# Set trust level explicitly
arcana trust set high

Permission Policy

The permission system decides what happens at each trust boundary. Actions are classified by risk level:

  • Low risk. Auto-allowed in most configurations (file reads, code search, web fetches to known domains)
  • Medium risk. Auto-allowed based on trust level (file writes, shell commands in project scope)
  • High risk. Always requires approval (network requests to unknown domains, git push, destructive operations)

The Signal Engine

Arcana includes a signal engine that classifies agent actions in real-time. It evaluates each action against the current trust configuration and permission policy, then decides whether to allow, gate, or block the action. This is the firewall for AI agent behavior.

Workspace Trust vs. Global Trust

Trust can be set globally or per-workspace. A workspace-level override takes precedence. This means you can have high trust in your personal projects and lower trust in client work, all within the same Arcana installation.

Practical Trust Configuration

Trust is configured in your Arcana config file. The location depends on your operating system:

  • Linux / macOS: ~/.arcana/config.json
  • Windows: %USERPROFILE%\.arcana\config.json

Here is a typical trust configuration for a development workflow:

{
  "trust": {
    "workspace": "high",
    "network": {
      "knownDomains": ["api.github.com", "registry.npmjs.org"],
      "unknownDomains": "ask"
    },
    "fileEditGuard": "auto",
    "gitOps": {
      "commit": "ask",
      "push": "ask",
      "branch": "auto"
    }
  }
}

This configuration lets the agent read and write project files freely, fetch from known API domains, and create branches without asking. It requires approval for git commits, git pushes, and network requests to unknown domains. This is a reasonable starting point that balances productivity with safety.

Why Boundaries Matter

Without explicit boundaries, an AI agent operates on a spectrum from "read-only assistant" to "unrestricted executor." Most tools leave this implicit. Arcana makes it explicit, auditable, and configurable. You know exactly what the agent can do, and you decide where the lines are.

The result is an agent you can trust not because it is trustworthy by nature, but because its behavior is constrained by a system you control. Trust is earned through transparency, not assumed through optimism.

Related Reading