Permissions and audit

Agents in Kleinia can reach the whole system, so the system decides what each of them may do. Permissions follow risk: the more an action could cost you, the more the system involves you.

Tiered permissions

Risk	Examples	What happens
Low	Reading files in the task’s project, switching a scheduling policy, calling another agent’s read-only skill	Runs automatically and is recorded
Medium	Installing an app, writing outside the task’s project	Runs and notifies you
High	Deleting files, sending data off the device, changing system settings	Waits for your confirmation

Permissions per task

An agent gets only what its current task needs, and the grant ends when the task ends. A coding agent working on one project does not keep access to your other folders once it is done.

Model permissions and quotas

Which models an agent may use, and how many tokens it may spend, are set in the unified model gateway and enforced by the system, not by the agent.

Audit

Every model call, tool call and system action an agent makes is written to its execution trace:

agentctl trace

See Monitor agents. System-level changes can be undone with a rollback.

The model behind it

The ACOS security model covers every link from the user to the agent, the connection and the device:

Authenticated. The user, the agent, the connection and the device all prove who they are.
Permitted. The agent holds a grant for this action, scoped to a task.
Capable. Sensitive data only goes to devices that meet the required security level.
Owned. Data does not leave its owner’s boundary: personal data stays personal, and work data stays with work.