[{"data":1,"prerenderedAt":505},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fsecurity":3,"docs-nav":393},{"id":4,"title":5,"body":6,"description":384,"extension":385,"meta":386,"navigation":387,"order":388,"path":389,"seo":390,"stem":391,"__hash__":392},"docs\u002Fdocs\u002F9.security.md","Security and trust",{"type":7,"value":8,"toc":376},"minimark",[9,13,18,97,100,121,125,297,300,347,351,365,368],[10,11,12],"p",{},"jawb's caller is an AI agent that reads untrusted web pages and can be\nsteered by what it reads. So jawb's security starts from one question:\nwho is trusted to do what? This page answers it, then separates what is\nbuilt today from what is planned.",[14,15,17],"h2",{"id":16},"threat-model","Threat model",[19,20,21,37],"table",{},[22,23,24],"thead",{},[25,26,27,31,34],"tr",{},[28,29,30],"th",{},"Who",[28,32,33],{},"Trust",[28,35,36],{},"What that means",[38,39,40,55,67,84],"tbody",{},[25,41,42,46,52],{},[43,44,45],"td",{},"Web pages",[43,47,48],{},[49,50,51],"strong",{},"Untrusted",[43,53,54],{},"Page content, redirects, cookies, scripts and declared tools are treated as hostile input.",[25,56,57,60,64],{},[43,58,59],{},"Other users on the same machine",[43,61,62],{},[49,63,51],{},[43,65,66],{},"The data directory is owner-only, and the daemon needs a token they cannot read.",[25,68,69,72,77],{},[43,70,71],{},"Your agent, and any program running as you",[43,73,74],{},[49,75,76],{},"Semi-trusted",[43,78,79,80,83],{},"It may act within policy. It may ",[49,81,82],{},"not"," authorize an effect that needs a person, such as a purchase. jawb does not hide your own profile's data from it.",[25,85,86,89,94],{},[43,87,88],{},"You",[43,90,91],{},[49,92,93],{},"Trusted",[43,95,96],{},"Through a channel the agent cannot drive.",[10,98,99],{},"Malware running as your user with UI-automation rights, and an\nadministrator or kernel compromise, are out of scope for any local tool,\njawb included.",[10,101,102,105,106,110,111,114,115,120],{},[49,103,104],{},"One gap is open on macOS and Linux."," On Windows, ",[107,108,109],"code",{},"jawbd"," asks Windows\nHello to verify you before a purchase proceeds, and a program that only\nreads jawb's files cannot produce that verification. macOS and Linux have\nno verifier yet: approvals there come from a terminal prompt backed by a\ncredential file in the data directory, and are recorded as ",[107,112,113],{},"asserted",".\nAny program running as you can read that file and approve, so on those\nsystems jawb does not meet this model for purchases yet (see\n",[116,117,119],"a",{"href":118},"#planned","Planned",").",[14,122,124],{"id":123},"built-today","Built today",[126,127,128,146,152,158,164,174,243,285,291],"ul",{},[129,130,131,134,135,137,138,141,142,145],"li",{},[49,132,133],{},"A local daemon only you can reach."," ",[107,136,109],{}," listens on loopback\nonly, with no remote mode. Every ",[107,139,140],{},"\u002Fv1"," call except the health check\nneeds a bearer token from the data directory, requests that carry a\nbrowser ",[107,143,144],{},"Origin"," header are refused, and the CLI refuses daemon\naddresses that are not canonical loopback.",[129,147,148,151],{},[49,149,150],{},"An owner-only data directory."," Profiles, tokens and keys live in a\ndirectory only your user can read, written in a crash-safe way, with\none daemon per directory.",[129,153,154,157],{},[49,155,156],{},"Encrypted profiles."," Cookies and storage are encrypted at rest with\na per-profile key held by the OS key store, or by a keyfile you supply\non hosts without one. Encryption protects against other users and\noffline theft of the disk. It does not protect against your agent,\nwhich acts with your profile.",[129,159,160,163],{},[49,161,162],{},"Incognito sessions."," Their state lives in memory. A download you ask\nfor in incognito is deleted when the session ends, and any left behind\nby a crash are removed the next time the daemon starts.",[129,165,166,169,170,173],{},[49,167,168],{},"A confirmation policy."," Uploads, downloads of executable or unknown\nfile types, filling a password or card field, and submitting a form\nthat has one need a confirmation. Every policy decision is written to\n",[107,171,172],{},"jawb trace",".",[129,175,176,179,180,183,184,186,187,190,191,194,195,198,199,201,202,204,205,236,239,242],{},[49,177,178],{},"A purchase hold."," Purchase-like actions are held as a pending\nconfirmation, and no approval token is ever issued to the agent that\ntriggered them. ",[107,181,182],{},"--yes"," never satisfies the hold, and no flag does. A\nperson approves through one of the approval channels, in this order by\ndefault: the jawb desktop app (in development), the operating system's\nown verification prompt that ",[107,185,109],{}," raises itself (Windows Hello\ntoday), and the terminal, by typing ",[107,188,189],{},"purchase"," at ",[107,192,193],{},"jawb confirm",". An\napproval from the terminal still asks Windows Hello where it is\navailable. Each approval is bound to the exact request you were shown,\nruns exactly one held action, and expires (120 seconds by default).\nEvery approval is recorded with how it was made: ",[107,196,197],{},"verified"," when the\noperating system verified you, ",[107,200,113],{}," when jawb could not check.\nPages opened in jawb can never reach ",[107,203,109],{},"'s own control port. jawb\nholds purchase-like actions at three layers, plus a fourth by default:",[206,207,208,214,220,226],"ol",{},[129,209,210,213],{},[49,211,212],{},"A classifier, before the action runs."," It matches purchase\nwords in several languages (\"Place your order\", \"Buy now\",\n\"Subscribe\") on the control being activated, payment fields, and\nforms that submit to a checkout step. Enter, Space and typed\nnewlines are classified like the click they trigger.",[129,215,216,219],{},[49,217,218],{},"A marker on purchase-like submissions",", checked at the network\nlayer. A marked request fails unless the action carries a\nhuman-approved token.",[129,221,222,225],{},[49,223,224],{},"An effect-level hold."," While an agent action runs, and for 3\nseconds after it ends, any state-changing request to a checkout-like\npath, or one that carries a payment card number, is held, however\nthe page built it.",[129,227,228,231,232,235],{},[49,229,230],{},"A payment-context hold",", in the default ",[107,233,234],{},"strict"," detection mode.\nOn a page with a payment field, a frame from a known payment\nprovider, or a checkout path, every state-changing request from that\ntab is held while an agent action runs and refused otherwise, for 30\nminutes after the last payment signal.",[237,238],"br",{},[49,240,241],{},"What it does not cover:"," WebSocket handshakes, in either mode; a\npage with no payment signals at all, such as a one-click button on an\notherwise neutral page; requests sent more than 3 seconds after the\naction when no payment context exists; and a page that deliberately\ndisguises a purchase. On macOS and Linux a program running as you can\nstill approve (see the gap above). The hold is a safeguard for honest checkout flows, not a\nguarantee against a hostile page.",[129,244,245,134,248,251,252,255,256,259,260,263,264,267,268,255,271,273,274,277,278,281,282,284],{},[49,246,247],{},"A configurable gate with a floor.",[107,249,250],{},"config.toml"," in the data\ndirectory sets ",[107,253,254],{},"purchase.gate"," (",[107,257,258],{},"approve"," by default, ",[107,261,262],{},"deny"," to refuse\nevery purchase, ",[107,265,266],{},"allow"," to let them run with a warning) and\n",[107,269,270],{},"purchase.detection",[107,272,234],{}," by default, or ",[107,275,276],{},"standard","), globally or\nper profile, with ",[107,279,280],{},"jawb config"," from jawb 0.1.1. A value weaker than\nthe default takes effect only after a person approves it through the\nsame channels, and that approval lasts until the daemon exits, so an\nagent that edits the file and restarts ",[107,283,109],{}," does not switch the gate\noff.",[129,286,287,290],{},[49,288,289],{},"Bridge helpers in an isolated world."," jawb's helper scripts inside\nChrome run apart from the page's own JavaScript, so a page cannot\nremap the element ids an agent targets or forge the facts a click\nrelies on. Certificate errors fail navigation.",[129,292,293,296],{},[49,294,295],{},"No cloud-metadata access."," Link-local and cloud-metadata addresses\nare always refused, including after a redirect or a DNS answer that\npoints there. No flag allows them.",[14,298,119],{"id":299},"planned",[126,301,302,308,323,329,335,341],{},[129,303,304,307],{},[49,305,306],{},"Content-integrity guardrails."," jawb will hand the agent what a\nperson reading the page would see, and flag what they would not:\nCSS-hidden, off-screen, zero-size or same-colour text; zero-width and\nbidirectional Unicode tricks; and instructions hidden in tool\ndescriptions. Hidden content is dropped from the default observation,\nor kept and marked with the reason it is hidden, so you can still\ninspect it. Every piece of page content will carry where it came from\n(page, frame, declared tool) and an untrusted label, kept structurally\napart from jawb's own messages. This is in research now.",[129,309,310,313,314,317,318,322],{},[49,311,312],{},"A local-network rule."," Opening ",[107,315,316],{},"localhost"," or a LAN address yourself\nstays allowed with no flag, because local automation and UAT testing\nagainst dev servers are primary uses of jawb. A public page that\nredirects or sends requests ",[319,320,321],"em",{},"into"," your local network will be blocked\nunless you allow it for a profile or a command.",[129,324,325,328],{},[49,326,327],{},"Encrypted per-session downloads."," Downloads encrypted with a key\nthat lives only in memory for the session, so even a crash or a hard\nkill leaves only unreadable files.",[129,330,331,334],{},[49,332,333],{},"OS-verified purchase approval on macOS and Linux",", which closes the\nopen gap in the threat model there, and the jawb desktop app as an\napproval channel.",[129,336,337,340],{},[49,338,339],{},"One gate for every route."," When declared-tool invocation and native\nactions arrive, they go through the same purchase and policy checks as\na click. A cheaper route is never a weaker one.",[129,342,343,346],{},[49,344,345],{},"Account sign-in."," Everyone will sign in with a jawb account (Firebase\nAuthentication). Sign-in and licence refresh send your account identity,\nnever URLs, page content, history or traces. The daemon checks your\nlicence locally, and a signed-out or offline install keeps browsing\nduring a grace period.",[14,348,350],{"id":349},"what-jawb-does-and-does-not-claim","What jawb does and does not claim",[10,352,353,354,357,358,361,362,364],{},"jawb aims to ",[49,355,356],{},"reduce"," an agent's exposure to hidden prompt injection,\nand to ",[49,359,360],{},"contain"," its consequences, so that injected instructions cannot\nspend money or move data without you. It does ",[49,363,82],{}," prevent prompt\ninjection. The model still decides what to do with what it reads, and it\ncan be misled by text that is plainly visible.",[10,366,367],{},"These protections are part of the free product. Safety is never a paid\nfeature.",[10,369,370,371,375],{},"See ",[116,372,374],{"href":373},"\u002Fdocs\u002Froadmap","Roadmap and status"," for everything else that is built\nand planned.",{"title":377,"searchDepth":378,"depth":378,"links":379},"",2,[380,381,382,383],{"id":16,"depth":378,"text":17},{"id":123,"depth":378,"text":124},{"id":299,"depth":378,"text":119},{"id":349,"depth":378,"text":350},"Who jawb trusts, the protections built today, and the ones planned.","md",{},true,null,"\u002Fdocs\u002Fsecurity",{"title":5,"description":384},"docs\u002F9.security","X2vKKDXziVqZNrae6zDT6WKFHSgLrPf6UjZ-szJzBtM",[394],{"title":395,"path":396,"stem":397,"children":398},"Documentation","\u002Fdocs","docs\u002F1.index",[399,400,404,408,410,432,474,488,492,496,500,504],{"title":395,"path":396,"stem":397},{"title":401,"path":402,"stem":403},"Protocol adapters","\u002Fdocs\u002Fprotocol","docs\u002F10.protocol",{"title":405,"path":406,"stem":407},"Extensions","\u002Fdocs\u002Fextensions","docs\u002F11.extensions",{"title":374,"path":373,"stem":409},"docs\u002F12.roadmap",{"title":411,"path":412,"stem":413,"children":414},"Getting started","\u002Fdocs\u002Fgetting-started","docs\u002F2.getting-started\u002F1.index",[415,416,420,424,428],{"title":411,"path":412,"stem":413},{"title":417,"path":418,"stem":419},"Installation","\u002Fdocs\u002Fgetting-started\u002Finstallation","docs\u002F2.getting-started\u002F2.installation",{"title":421,"path":422,"stem":423},"Desktop app","\u002Fdocs\u002Fgetting-started\u002Fdesktop-app","docs\u002F2.getting-started\u002F3.desktop-app",{"title":425,"path":426,"stem":427},"Running the daemon","\u002Fdocs\u002Fgetting-started\u002Frunning-the-daemon","docs\u002F2.getting-started\u002F4.running-the-daemon",{"title":429,"path":430,"stem":431},"Using the CLI","\u002Fdocs\u002Fgetting-started\u002Fusing-the-cli","docs\u002F2.getting-started\u002F5.using-the-cli",{"title":433,"path":434,"stem":435,"children":436},"CLI reference","\u002Fdocs\u002Fcli","docs\u002F3.cli\u002F1.index",[437,438,442,446,450,454,458,462,466,470],{"title":433,"path":434,"stem":435},{"title":439,"path":440,"stem":441},"JSON envelope and exit codes","\u002Fdocs\u002Fcli\u002Fjson-and-exit-codes","docs\u002F3.cli\u002F10.json-and-exit-codes",{"title":443,"path":444,"stem":445},"jawb status","\u002Fdocs\u002Fcli\u002Fstatus","docs\u002F3.cli\u002F2.status",{"title":447,"path":448,"stem":449},"Tabs, profiles and sessions","\u002Fdocs\u002Fcli\u002Ftabs-and-profiles","docs\u002F3.cli\u002F3.tabs-and-profiles",{"title":451,"path":452,"stem":453},"jawb observe [\u003Curl>] [--full] [--interactive-only] [--js]","\u002Fdocs\u002Fcli\u002Fobserve","docs\u002F3.cli\u002F4.observe",{"title":455,"path":456,"stem":457},"jawb read [--format md|text|json] [--element \u003Cid>] [--full] [--js]","\u002Fdocs\u002Fcli\u002Fread","docs\u002F3.cli\u002F5.read",{"title":459,"path":460,"stem":461},"Act commands","\u002Fdocs\u002Fcli\u002Fact","docs\u002F3.cli\u002F6.act",{"title":463,"path":464,"stem":465},"See commands","\u002Fdocs\u002Fcli\u002Fsee","docs\u002F3.cli\u002F7.see",{"title":467,"path":468,"stem":469},"Policy and confirmation","\u002Fdocs\u002Fcli\u002Fpolicy","docs\u002F3.cli\u002F8.policy",{"title":471,"path":472,"stem":473},"Install lifecycle and profile settings","\u002Fdocs\u002Fcli\u002Flifecycle","docs\u002F3.cli\u002F9.lifecycle",{"title":475,"path":476,"stem":477,"children":478},"SDK reference","\u002Fdocs\u002Fsdk","docs\u002F4.sdk\u002F1.index",[479,480,484],{"title":475,"path":476,"stem":477},{"title":481,"path":482,"stem":483},"Rust SDK — jawb-sdk-rust","\u002Fdocs\u002Fsdk\u002Frust-sdk","docs\u002F4.sdk\u002F2.rust-sdk",{"title":485,"path":486,"stem":487},"Website SDK — @4hum-ai\u002Fjawb-sdk","\u002Fdocs\u002Fsdk\u002Fwebsite-sdk","docs\u002F4.sdk\u002F3.website-sdk",{"title":489,"path":490,"stem":491},"Configuration","\u002Fdocs\u002Fconfig","docs\u002F5.config",{"title":493,"path":494,"stem":495},"WebMCP","\u002Fdocs\u002Fwebmcp","docs\u002F6.webmcp",{"title":497,"path":498,"stem":499},"Agents","\u002Fdocs\u002Fagents","docs\u002F7.agents",{"title":501,"path":502,"stem":503},"MCP server","\u002Fdocs\u002Fmcp","docs\u002F8.mcp",{"title":5,"path":389,"stem":391},1792595702202]