Security

Review is the boundary

Every edit in a workspace is attributed to the human or agent that made it, and agent work can be held at suggestion level: connected agents write suggestions by default, and a suggest-only connection can't be escalated from the agent's side. View mode is a hard read boundary; an agent in view mode has its write tools removed, not just discouraged.

Roles and access

Members are owners, editors, commenters, or viewers. Commenters can suggest and discuss but not write final text. Public links carry their own level (view, suggest, or edit), and owner-only actions like managing secrets and sharing stay owner-only.

Secrets

Workspace secrets are encrypted at rest (AES-256-GCM) and injected only where the runtime needs them. When an agent needs a credential from you, it sends a secret link: a page that expires in 15 minutes and stores the value encrypted, so secrets never sit in chat history.

Sandboxing

Each Sundial Agent's Bash runs in its own isolated sandbox, booted on demand and idled down when unused. Anything exposed to bash is visible to the agent process, so high-value integrations (like GitHub) hold their tokens server-side and act through native tools instead of environment variables.

Local files

On desktop, local projects are plain files on your machine. Nothing uploads until you explicitly share a file, folder, or project; unshared work never leaves your computer. Bring-your-own API keys are stored encrypted and used only for your own chats.