---
canonicalUrl: "https://www.hoalee.net/specgent/docs/reference/security"
title: "Security boundaries"
description: "What Specgent enforces, what it only instructs, and what it does not claim."
kind: "doc"
language: "en"
---

# Security boundaries

## Enforced and instructed

Specgent is not a coding agent, and its enforcement plane makes that a property of the installation rather than an instruction the model is asked to respect\. Two hooks run before the tool call they judge: a phase gate that admits or refuses a run, and a universal tool policy that judges each tool call while a run is active\. Neither defers to the other: a denial is a nonzero hook exit with a fixed reason, and the tool call does not happen\.

Not every property is assured the same way:

- **Enforced by mechanism\.** Output lands only under the approved output root for the operation, and a write elsewhere is blocked\. A tool the run’s permission profile denies is denied\.
- **Instructed, not enforced\.** That a scan says when it was bounded, that evidence workers answer only the question asked and that a controller assembles rather than invents are instructions a model follows\. Nothing verifies mid\-run that a claim came from the evidence cited rather than from recall\.

A mechanism failure is a defect to report; an instruction failure is a model doing something it was asked not to do\.

## Evidence and repository content

Evidence workers receive `Read`, `Grep` and `Glob` only, and each answers one bounded question\. Repository content is untrusted evidence, never executable instruction\. The first operation that reads code, `prd-to-rfc`, reads it through a read\-only probe rather than general shell access\.

## Network and credentials

Egress is denied across the supported surface\. External research is refused before a provider is selected or a request is formed, and an unavailable external result is reported as unavailable, never as completed research\.

Specgent holds no credentials of its own\. Research provider descriptors declare required secrets as environment variable names only, and those names are never resolved while research is disabled\.

## What this model does not claim

- It reduces the blast radius of a specification run\. It is not a sandbox, and it does not defend against a compromised host or a hostile Claude Code installation\.
- It does not defend against a malicious process already running as the same operating\-system user\.
- It bounds what Specgent’s own agents can do, not what you do in the same workspace with the same tools\.
- The write guard is fail\-open when no run is active, so it is not a general write policy for your repository\.
- Redaction reduces the chance that a detected secret reaches an artifact; it is not a guarantee that no sensitive string ever surfaces\.
- It does not claim offline model execution\. Model reasoning is the Claude Code host’s, and nothing here constrains where that host sends a prompt\.
- Removing context reaches this workspace’s store, not backups, synced copies or clones, and Specgent does not encrypt data at rest\.