Security
Permission model
The permission set, what each one allows, and what is not available.
Availability note — these docs describe both working and planned product areas. Account authentication, administrator-managed AIHK/AICA tenant regions and keys, signed-in Composer runs and public Guard scans are connected. Skills, Memory, Agents, Workflows, Apps, billing, the public SDK/CLI and the unified API are previews unless a section explicitly says otherwise.
Roadmap and package-contract reference: this page describes the intended GenCMS runtime. The current deployment persists workspace records and drafts but does not execute marketplace Skills, index Memory for retrieval, publish packages, or run Agents, Workflows or Apps. See the deployed API reference for the routes available today.
Permissions are declared in the manifest, shown before install and enforced at run time. A Skill can only do what it declared, and Guard reports the gap when the code does more.
| Permission | Allows | In MVP |
|---|---|---|
web.fetch | Fetch public web pages | Yes |
files.read | Read files supplied to the run | Yes |
files.write | Write output files inside the run directory | Yes |
http.call | Call external HTTP endpoints | Yes |
memory.read | Read Memory collections granted to the run | Yes |
memory.write | Write to Memory collections granted to the run | Yes |
api.call | Call GenCMS API endpoints | Yes |
code.execute | Execute code in the sandbox | Restricted |
| email.read / email.send | Mailbox access | No |
| calendar.read / calendar.write | Calendar access | No |
| shell | Host shell execution | No — not available to marketplace Skills |
Enforcement
- Secrets are held outside the package and never passed into it as environment.
- Execution has a timeout and a size limit.
- Network egress is controlled per permission, not per package.
- Memory access is scoped to the collections granted for that run.
- Every run is logged with the permissions it actually exercised.
- A kill switch can disable a Skill everywhere it is installed.