Safety and data
What stays on your machine, what a step can reach, and what needs your approval.
What stays on your machine, what a step can reach, and what needs your approval. These pages describe the shipped factory. Limits sit next to the protections.
| Question | Short answer |
|---|---|
| Where does the factory run? | On your machine. It starts no cloud agents or remote workers. |
| What leaves my machine? | What an agent step sends to the model provider you configured, as with any session of that tool. Telemetry and anonymous usage reports are off unless you turn them on. |
| Can it push or merge? | No. It delivers a local commit; you merge and push. |
| What can a step touch? | Its worktree and its own folders. Optional OS sandbox (sandbox.mode: required) contains writes, and sandbox.network: allowlist limits outbound hosts. |
| What about secrets? | Kept out of kusaw.yaml by name, passed only to the steps you name, and redacted from logs. |
| What needs my approval? | Gates you put in the pipeline, and anything outside the factory such as merging. |
Where does the factory run?
On your machine. You install a local binary and serve the factories you registered. The factory starts no cloud agents and no remote workers. The Dashboard, when you open it, is on 127.0.0.1.
What leaves my machine?
An agent step sends the code and text it reads to its provider: the Claude Code you already configured, or Cursor if you enabled it for that step. That is the same as any session of that tool. The factory does not ask for credentials or pick a model. Telemetry and anonymous usage reports (kusaw reporting) are off unless you turn them on. Detail: What stays local and what doesn't.
Can it push or merge?
No. Delivery is a local commit and a SUMMARY.md in the run directory. The factory does not push and does not merge. You do that yourself. Detail: What needs your approval.
What can a step touch?
A step is meant to work in its worktree and the run's own folders under data_dir. With sandbox off, the process still runs with your user's permissions. With sandbox.mode: required, the factory wraps the step in Seatbelt or Bubblewrap so writes stay in the worktree, artifacts, and a private temp folder. The network is open by default; with sandbox.network: allowlist, a sandboxed step reaches only the hosts you allow, through a local proxy. Detail: What a step can reach, OS sandbox.
What about secrets?
Do not put secret values in kusaw.yaml. Pass extra environment by name through access.env.allow and step.env_allow to the steps that need it. Redact patterns strip matches from logs, events, and artifacts. Redaction does not stop an agent step from sending a secret it reads to the model provider. Detail: What stays local and what doesn't.
What needs my approval?
Gates you put in the pipeline wait for you. Self-improvement proposals are not applied until you approve them. Merge, push, and publishing stay outside the factory. Detail: What needs your approval.