An Agent with Real Capability Needs Real Controls
Helix assumes an autonomous agent will eventually attempt an action it should not. The 8-gate pipeline below stands between that attempt and your systems, and every single decision produces a cryptographically signed CloudEvent audit log.
The 8-Gate Tool Defense Pipeline
Gate 1: Owner / Channel Auth
agent.auth.verifiedValidates caller identity, active workspace membership, and cryptographically verifies webhook signatures before allowing any execution.
{"loading": true}
Every Tool Call Sequenced in Turn
Tool calls never bypass this pipeline. The first gate that refuses terminates the call, commits the refusal event to the tamper-proof ledger, and allows the turn to proceed with remaining permissions.
Confirms the requester may act in this workspace, and that an approval arrived from a channel authorised to give it.
Matches the command argv against 137 denied-command shell regexes, fork bombs, and workspace denylists before anything executes.
Refuses any capability above the maximum the workspace owner set (Policy ∩ Profile), whoever asked for it.
Refuses reads and writes to protected paths that cannot be allowlisted, such as credential stores, dotfiles, and /proc.
Holds the call for human authorization under Interactive, Trust-Command, Trust-Tool, or Autopilot policies.
Checks arguments strictly against the tool's schema so malformed or adversarial calls fail before reaching a sandbox.
Executes inside Fly.io Sprites microVMs, Docker, WASM fuel-metered runtimes, or Landlock backends with zero network egress in strict mode.
Strips private keys, bearer tokens, and secrets from output before it re-enters the model context or an artifact.
Hermetic Isolation
- Tool calls never run in the application process. Local, Docker container, WASM fuel-metered plugin, and Fly.io Sprites Firecracker microVM backends implement one unified behaviour.
- Strict sandboxes enforce zero network egress. An agent that requires external package registries or APIs must be granted explicit capability bindings.
- Container sandboxes are destroyed at session end. MicroVM checkpoints are copy-on-write branched and encrypted at rest.
- Workspace BYOK credentials are encrypted at rest using AES-256-GCM envelope encryption with per-workspace key derivation and masked in every UI surface.
- A crashed sandbox is a supervised failure: the BEAM fiber restarts in < 2ms with its objective intact, and the crash is recorded as a typed CloudEvent.
Cryptographic Evidence
- Every turn, step, tool call, denial and approval is a typed, versioned CloudEvent with a monotonic UUIDv7 sequence number.
- W3C PROV-O decision lineages and JTMS (Justification-Based Truth Maintenance) record the deciding identity, matched policy, and full argv for cryptographic auditability.
- A session replays deterministically from event 0, meaning an incident review reproduces exact execution rather than reconstructing it from fragments.
- Regulated Domain Packs enforce domain-specific guardrails: HIPAA Safe Harbor 18-identifier PHI scrubbing, SOX Section 404 immutable ledgers, and attorney-client privilege walls.
- Self-serve GDPR & India DPDP Act compliance provides one-click portable workspace exports and cascading right-to-erasure with 64-byte SHA-256 cryptographic audit receipts.
Where Our Responsibility Ends
Being transparent about security boundaries matters more than compliance badges. A ceiling you configure too high is not something external runtime software can protect you from.
| Area | We are responsible for | You are responsible for |
|---|---|---|
| Isolation | Sandbox backends behaving as documented, and strict mode having no egress | Choosing the backend appropriate to the work |
| Capability | Enforcing the ceiling on every call, with no bypass | Where you set the ceiling, and which tools you allowlist |
| Approvals | Holding the call, recording the decision, expiring stale requests | Who may approve, and what they approve |
| Credentials | AES-256-GCM encryption at rest and automatic secret redaction from output | Which credentials you give a workspace, and their scope |
| Data & Privacy | Encryption, retention enforcement, self-serve GDPR/DPDP export & SHA-256 erasure receipts | What data you ingest, and your workspace retention setting |
Reporting a Vulnerability
Email security@helixloop.ai. We acknowledge within one business day and honor safe-harbor security research.
Compliance & DPAs
We countersign DPAs, GDPR/DPDP addenda, and vendor security questionnaires for Team and Enterprise customers. Contact legal@helixloop.ai.
Incident Forensics
We notify affected workspace owners promptly with full deterministic event log transcripts and counterfactual impact reports.