Repository navigation
Using the Agent
The agent is designed to act through the browser without becoming the authority. The model proposes and reasons; the policy kernel, tool gateway, and user approvals decide what can actually happen.
- You give the agent a goal.
- The agent builds a plan.
- You review the plan before execution.
- The runtime perceives the page and calls browser tools.
- Tool calls pass through the policy gateway.
- Risky or tainted actions ask for approval.
- Events are written to the journal so the run can be reviewed later.
Human-in-the-loop approval is not cosmetic. It is enforced in the privileged side of the application, not only in the renderer UI. A missing or timed-out approval fails closed.
Actions that can escalate include:
- state-changing browser actions,
- destructive actions,
- financial actions,
- arguments derived from untrusted page content,
- sensitive site categories such as banking, crypto, health, government, or password managers.
The codebase distinguishes routine actions from dangerous actions. Higher autonomy can reduce routine interruptions, but it cannot grant the model permission to bypass hard blocks. Sensitive grants and mandates are separate design objects, and many are not live yet.
Cloud provider keys are BYO-key. They are stored via the OS keychain and are not sent to a Tepegoz server. Page content and prompts go directly to the provider selected by the user.
The model gateway requires timeouts and max-token limits. Token usage is recorded by provider, model, and capability, and the UI can warn when a configured quota is nearing exhaustion.
Do not treat current agent behavior as independently proven. The AI competence program has code landed, but its phases are still measurement-owed. This wiki should not describe Tepegoz as "better than" another agent until a measured artifact exists.
docs/ai-transparency.mddocs/threat-model.mdphases/ai-agent/README.mdpackages/agent-runtimepackages/capability-planepackages/security-policy