Data & Privacy

This is not a privacy policy. It is an architectural description — where your agent runs, where its data lives, and what leaves the machine.

The short version: the runtime runs where you run it. The loop, the capsule, your tools, your data — all of it executes on your machine in local development, or inside your agent's own container when deployed. What crosses the network is determined by two things you choose: your engine, and your policy.

The kernel is the perimeter

Every action the agent takes — every file read, every shell command, every network call — is bounded by the policy you declared in axon.config.ts before any code runs. On Linux there is no path around it: the agent process runs inside a box whose filesystem, network and environment are only what the policy granted.

export default defineAgent({
    policy: {
        fs:  { read: ["./src"], write: ["./output"] },
        net: { allow: ["api.github.com:443"] },
        env: { allow: [] },
    },
})

An agent with this policy cannot read .env, cannot write outside ./output/, cannot reach any host but api.github.com, and receives none of the environment variables in your shell. The model may want to. The kernel won't let it.

On Linux those are OS facts rather than checks: an ungranted path does not exist inside the box, an ungranted host is unroutable from its network namespace, and the environment is built from nothing rather than inherited. On macOS and Windows only the mediator runs, so fs, net, env and limits are unenforced there — a real difference, and the reason the tier is reported rather than assumed.

Your privacy posture is your policy — committed to git, auditable, version-controlled. Tighten it to what the agent genuinely needs. See Kernel & Policy for how enforcement works.

Where your credentials are

Not in the box. The provider key for inference is held by the supervisor — the process that owns the agent, outside its sandbox. The agent asks for a role and receives tokens back, so there is no engine credential inside the box for model-emitted code to read, log, or send anywhere.

Your agent's own credentials — a GitHub token a tool needs, an API key for a service it calls — live in its .env, beside its code and gitignored. Those do cross into the box, because the tool that needs them runs there. Nothing else does: the box's environment is built from that file plus whatever env.allow names, never inherited from your shell.

Where tokens go

Inference is the one flow that necessarily leaves the agent, and the engine decides where it goes:

Axon() — managed inference through Axon Cloud, billed to your account. Context windows flow to Axon and on to the model provider.

OpenRouter(), Codex(), Cerebras() — tokens flow from your machine directly to your provider. Axon is not in that path. Your provider contract governs that surface.

Ollama() — inference on your own hardware. No tokens leave your machine. The full runtime — loop, capsule, tools — was already local; with a local engine, everything is.

The isolation spectrum

Different threat models, increasing separation — each step is a deployment choice, not a configuration system:

Local development — everything on your machine; inference via whichever engine you chose. With Ollama(), fully self-contained.

Axon Cloud deployment — your agent runs in its own isolated container with its own durable data/. Axon manages the infrastructure; your policy still governs everything the agent does inside it.

Self-managed — the base image runs your agent from a mount on your own infrastructure, with your own engine choice. Combined with local inference, no tokens leave hardware you control.

You define the environment. You define the policy. The agent operates within both.