Permissions, security and data

Windows local operation

The default task-service route uses a local named pipe limited to the current Windows user. Local MCP uses standard input/output. Optional local HTTP mode listens on loopback and uses a startup token; optional internet mode is a separate configuration with authenticated remote entry.

Treat other processes running under the same Windows account as trusted. The local user boundary is not isolation from an untrusted program running as that user. Keep the workstation account controlled.

Camera credentials and configured model credentials use current-user Windows DPAPI protection. This is not portable credential storage: another user/computer must re-enter credentials. Never send raw configuration, session cookies, tokens or unredacted startup logs to support.

Remote workbench access

Remote access is explicitly enabled/configured by the desktop. The internet path validates Cloudflare Access identity and uses configured operator/model policy. Define narrow Access and model allowlists before use. A successfully authenticated model can have write-capable tools; model access is not inherently read only.

Device ownership, baseline checks, persistent write records and recovery fences constrain camera operations. A stale owner or interrupted task does not justify clearing the fence or deleting evidence. Cancellation and revocation do not prove that an already-issued remote action did not complete.

Use the supplied installer option to disable internet access where required. A malformed disable-policy file is treated as disabled. Final remote rollout, TLS/identity configuration and provider acceptance need their own validation; this documentation does not enable them.

Browser Lab data

The public Lab processes selected image pixels inside the browser. Its hosted entry form sends contact/consent details to the hosted service and sets an access cookie. Do not confuse local image processing with absence of all network requests: loading application assets and submitting the entry form still use the network.

The public build excludes account, relay, Codex-pairing and candidate custom-code UI. Research account builds have a separate identity/persistence model; email/password registration does not itself prove email ownership or establish an OAuth identity.

AI and custom code

In the Windows workbench, explicitly starting an AI optimization or using an external MCP client can send tool results and image samples to the selected provider/client. Review the recipient, data rights and provider policy before enabling it. A request-level store preference is not a guarantee about every downstream party's retention.

Windows custom Python nodes execute with service-user permissions and are not a security sandbox. Browser custom-code candidates use a different bounded runtime and separate build features; they are not a public Lab capability. Do not apply either model's guarantees to the other.

Logs, audit and support bundles

Task records, hashed evidence and an append-only audit chain support integrity checks. A local user can still modify the underlying store; an audit head retained independently helps detect wholesale rewriting. This is not third-party certification or tamper-proof storage.

For support, share only reviewed metadata: package/version, redacted error, operation/request ID, expected versus observed state and time. Scrub camera addresses, credentials, job values, customer images, business identifiers and model inputs. Startup output can contain local access tokens.

The safety snapshot exporter deliberately allowlists fields and states its limited scope. Even a successful snapshot does not establish camera connectivity, frame counts or acceptance completion.