# Security

thought stream has broad read access, so containment is a product property rather than deployment polish.

## Capability separation

Ingress can observe. Model cells can receive bounded context and produce typed proposals. Dispatchers hold narrow, explicit action capabilities. No layer inherits another layer's authority by proximity.

## Private data

Events carry a privacy class. Public-source derivations remain private by default because selection, routing, and model context can reveal private interests. Credentials, raw provider bodies, model reasoning, and malformed output are excluded from durable evidence.

## Public website

The public server renders only a fixed list of reviewed Markdown files. It has no Jazz handle, event query, manifest reader, trace reader, directory listing, arbitrary file route, or private upstream fallback. Unknown routes stop locally.

## Inspector authentication

The private inspector accepts an allowlisted ATProto identity through the official OAuth client. Protocol state and tokens stay encrypted on the server; the browser receives only a short-lived opaque session cookie. A separately configured Basic credential remains available as a break-glass path during activation.

OAuth proves identity only. It grants no write, publish, connector, model, dispatcher, or PDS-record authority.