Control what agents can do.

Connect to Guardian 0.30.0+ to load the server-side access policy.

No policy loaded.

Policy is saved on the VPS and shared by upgraded Guardian processes running as this SSH user. Older agents must upgrade and reconnect once. This is an MCP boundary, not isolation from root SSH or server-code access.

Give each AI agent its own password-locked Unix account and SSH public key. The key starts Guardian only; no shell or forwarding. No public web port or background service.

Connect as a VPS administrator to Guardian with Gateway support.

Create an agent

Observer is read-only. Project editor can stage and apply project-file changes in controlled mode, only where Linux permissions allow. Mission worker prepares private proposals; operator-only apply requires root-protected production files. Grant only the required file access separately; never add an agent account to sudo or the Docker group. Creation requires root in the operator connection. Revocation blocks new normal MCP calls and removes the SSH key, but cannot cancel work already running.

Review a Mission worker's private changes before anything reaches production. Approval and Apply are separate operator actions bound to the exact snapshot.

Operator review queue

Linux Gateway + separate administrator key required. First version: existing root-owned text files with protected parent directories, up to three files, 100 KB each (less on constrained hosts), 24-hour expiry. No commands, tests, new files, deletions or automatic replay. Applying multiple files is not one atomic transaction. Root/shared SSH credentials can bypass this boundary.

Explore project metadata inside the configured roots. No source is read and no project commands are executed.

Connect to Guardian 0.31.0+ on the VPS to browse projects.

Selecting or inspecting a project does not change agent permissions. Use as root prepares an Access draft; review and Apply permissions there. Explicit managed roots are shared; inherited roots may differ between agent launch environments.

Shared, server-enforced budgets for subsequent operations. Host protection always applies, including with Standard and Custom profiles.

Connect to Guardian 0.31.0+ to load limits.

Capsule isolation stays fixed: 128 MiB RAM, 0.5 CPU, 30 seconds, 4 KiB output. These cooperative limits do not impose a global CPU/RAM quota, cancel in-flight operations or constrain ordinary SSH. Upgrade every agent's server executable to 0.31.0+ and reconnect once.

Shared with agents on this server, under this SSH user. Staged changes survive reconnects; this view never executes, approves or retries them.

Connect to Guardian 0.32.0+ to load shared operations.

Drafts expire after 24 hours. Up to 200 finished records are retained for 30 days; source payloads are removed on completion or expiry. An interrupted write can be uncertain: inspect live files, never blindly repeat it. Confirmation tokens remain session-local; preview again after reconnecting. Jobs have their own TTL and 100-record cap.