> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gatetrix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> Understand what Access's permission controls enforce, their limits, and how to reduce the authority available to an agent.

Access helps you give agents selected tools, resources, and operations, with
approval rules and an audit trail. It is a local permission layer implemented
in software. **Access is not a sandbox for the agent or the programs it runs.**

## What Access controls

Calls made through Access are checked against their credential, profile grants,
operation rules, approvals, and rate limits. Connector credentials are kept in
macOS Keychain and used by Access to contact the configured service.

Configuration Mode separately controls when an agent may prepare connection
definitions. An approval applies to the requested operation within its existing
permissions; it does not grant unrestricted access.

## Where the boundary ends

Like any software, Access can contain bugs. A defect in permission enforcement
could allow an agent to do more through Access than your configured permissions
intend. Do not treat a profile as an absolute isolation guarantee.

Access also does not restrict an agent's independent shell, filesystem, browser,
or service access. A local MCP server runs as your macOS user; Access does not
sandbox that program's own behavior. Upstream tools and APIs retain their own
semantics and permission controls.

Keeping a service credential out of an agent's prompt does not keep tool results
out of its context. Data returned to an agent may be processed by its provider.
See [Privacy](/privacy) and [Data and permissions](/data-and-permissions).

## Choose a smaller scope

* Give each agent only the connections and operations needed for its task.
* Use restricted provider tokens, selected accounts, and limited database roles
  as additional controls. Access rules do not replace those restrictions.
* Review upstream MCP tools and local executables before enabling them.
* Require approval for consequential operations and review audit activity.
* Close Configuration Mode when setup is finished, revoke unused credentials,
  and keep Access updated.

If you find behavior that appears to bypass an intended restriction,
[report a security issue](/report-security-issue). Send it directly to our team
so we can investigate.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.