[{"data":1,"prerenderedAt":308},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fv2\u002Fconcepts\u002Fdata-and-privacy":3},{"id":4,"title":5,"body":6,"description":16,"extension":301,"meta":302,"navigation":303,"path":304,"seo":305,"stem":306,"__hash__":307},"docs\u002Fdocs\u002Fv2\u002Fconcepts\u002Fdata-and-privacy.md","Data & Privacy",{"type":7,"value":8,"toc":296},"minimark",[9,13,17,25,30,38,178,193,207,211,219,227,241,253,257,260,269,279,289,292],[10,11,5],"h1",{"id":12},"data-privacy",[14,15,16],"p",{},"This is not a privacy policy. It is an architectural description — where your agent\nruns, where its data lives, and what leaves the machine.",[14,18,19,20,24],{},"The short version: ",[21,22,23],"strong",{},"the runtime runs where you run it."," The loop, the capsule, your\ntools, your data — all of it executes on your machine in local development, or inside\nyour agent's own container when deployed. What crosses the network is determined by two\nthings you choose: your engine, and your policy.",[26,27,29],"h2",{"id":28},"the-kernel-is-the-perimeter","The kernel is the perimeter",[14,31,32,33,37],{},"Every action the agent takes — every file read, every shell command, every network call\n— is checked by the kernel against the policy you declared in\n",[34,35,36],"code",{},"axon.config.ts"," before any code runs. There is no path around it: the agent process has\nno direct access to the filesystem, network, or shell.",[39,40,45],"pre",{"className":41,"code":42,"language":43,"meta":44,"style":44},"language-ts shiki shiki-themes dark-plus","export default defineAgent({\n    policy: {\n        fs: {\n            read:  [\".\u002Fsrc\u002F**\"],\n            write: [\".\u002Foutput\u002F**\"],\n            deny:  [\".env\", \"**\u002Fsecrets\u002F**\"],\n        },\n        network: {\n            allow: [\"api.github.com\"],\n        },\n    },\n})\n","ts","",[34,46,47,67,77,85,101,115,134,140,148,161,166,172],{"__ignoreMap":44},[48,49,52,56,59,63],"span",{"class":50,"line":51},"line",1,[48,53,55],{"class":54},"sYbnZ","export",[48,57,58],{"class":54}," default",[48,60,62],{"class":61},"sCudf"," defineAgent",[48,64,66],{"class":65},"sTNBD","({\n",[48,68,70,74],{"class":50,"line":69},2,[48,71,73],{"class":72},"s3F5K","    policy:",[48,75,76],{"class":65}," {\n",[48,78,80,83],{"class":50,"line":79},3,[48,81,82],{"class":72},"        fs:",[48,84,76],{"class":65},[48,86,88,91,94,98],{"class":50,"line":87},4,[48,89,90],{"class":72},"            read:",[48,92,93],{"class":65},"  [",[48,95,97],{"class":96},"sKc5r","\".\u002Fsrc\u002F**\"",[48,99,100],{"class":65},"],\n",[48,102,104,107,110,113],{"class":50,"line":103},5,[48,105,106],{"class":72},"            write:",[48,108,109],{"class":65}," [",[48,111,112],{"class":96},"\".\u002Foutput\u002F**\"",[48,114,100],{"class":65},[48,116,118,121,123,126,129,132],{"class":50,"line":117},6,[48,119,120],{"class":72},"            deny:",[48,122,93],{"class":65},[48,124,125],{"class":96},"\".env\"",[48,127,128],{"class":65},", ",[48,130,131],{"class":96},"\"**\u002Fsecrets\u002F**\"",[48,133,100],{"class":65},[48,135,137],{"class":50,"line":136},7,[48,138,139],{"class":65},"        },\n",[48,141,143,146],{"class":50,"line":142},8,[48,144,145],{"class":72},"        network:",[48,147,76],{"class":65},[48,149,151,154,156,159],{"class":50,"line":150},9,[48,152,153],{"class":72},"            allow:",[48,155,109],{"class":65},[48,157,158],{"class":96},"\"api.github.com\"",[48,160,100],{"class":65},[48,162,164],{"class":50,"line":163},10,[48,165,139],{"class":65},[48,167,169],{"class":50,"line":168},11,[48,170,171],{"class":65},"    },\n",[48,173,175],{"class":50,"line":174},12,[48,176,177],{"class":65},"})\n",[14,179,180,181,184,185,188,189,192],{},"An agent with this policy cannot read ",[34,182,183],{},".env",", cannot write outside ",[34,186,187],{},".\u002Foutput\u002F",", cannot\nreach any host but ",[34,190,191],{},"api.github.com",". The model may want to. The kernel won't let it.",[14,194,195,196,200,201,206],{},"Your privacy posture ",[197,198,199],"em",{},"is"," your policy — committed to git, auditable,\nversion-controlled. Tighten it to what the agent genuinely needs. See\n",[202,203,205],"a",{"href":204},"\u002Fdocs\u002Fv2\u002Fconcepts\u002Fkernel-and-policy","Kernel & Policy"," for how enforcement works.",[26,208,210],{"id":209},"where-tokens-go","Where tokens go",[14,212,213,214,218],{},"Inference is the one flow that necessarily leaves the agent, and the\n",[202,215,217],{"href":216},"\u002Fdocs\u002Fv2\u002Fagent\u002Fruntime\u002Fengines","engine"," decides where it goes:",[14,220,221,226],{},[21,222,223],{},[34,224,225],{},"Axon()"," — managed inference through Axon Cloud, billed to your account. Context\nwindows flow to Axon and on to the model provider.",[14,228,229,240],{},[21,230,231,128,234,128,237],{},[34,232,233],{},"OpenRouter()",[34,235,236],{},"Codex()",[34,238,239],{},"Cerebras()"," — tokens flow from your machine directly to\nyour provider. Axon is not in that path. Your provider contract governs that surface.",[14,242,243,248,249,252],{},[21,244,245],{},[34,246,247],{},"Ollama()"," — inference on your own hardware. ",[21,250,251],{},"No tokens leave your machine."," The\nfull runtime — loop, capsule, tools — was already local; with a local engine,\neverything is.",[26,254,256],{"id":255},"the-isolation-spectrum","The isolation spectrum",[14,258,259],{},"Different threat models, increasing separation — each step is a deployment choice, not\na configuration system:",[14,261,262,265,266,268],{},[21,263,264],{},"Local development"," — everything on your machine; inference via whichever engine you\nchose. With ",[34,267,247],{},", fully self-contained.",[14,270,271,274,275,278],{},[21,272,273],{},"Axon Cloud deployment"," — your agent runs in its own isolated container with its own\ndurable ",[34,276,277],{},"data\u002F",". Axon manages the infrastructure; your policy still governs everything\nthe agent does inside it.",[14,280,281,284,285,288],{},[21,282,283],{},"Self-managed"," — ",[34,286,287],{},"axon build"," produces a container image you can run on your own\ninfrastructure, with your own engine choice. Combined with local inference, no tokens\nleave hardware you control.",[14,290,291],{},"You define the environment. You define the policy. The agent operates within both.",[293,294,295],"style",{},"html pre.shiki code .sYbnZ, html code.shiki .sYbnZ{--shiki-default:#C586C0}html pre.shiki code .sCudf, html code.shiki .sCudf{--shiki-default:#DCDCAA}html pre.shiki code .sTNBD, html code.shiki .sTNBD{--shiki-default:#D4D4D4}html pre.shiki code .s3F5K, html code.shiki .s3F5K{--shiki-default:#9CDCFE}html pre.shiki code .sKc5r, html code.shiki .sKc5r{--shiki-default:#CE9178}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":44,"searchDepth":69,"depth":69,"links":297},[298,299,300],{"id":28,"depth":69,"text":29},{"id":209,"depth":69,"text":210},{"id":255,"depth":69,"text":256},"md",{},true,"\u002Fdocs\u002Fv2\u002Fconcepts\u002Fdata-and-privacy",{"title":5,"description":16},"docs\u002Fv2\u002Fconcepts\u002Fdata-and-privacy","edTbvxkezwX9kRc_W4ulYEQukA6R3835BdloUQDMKUM",1785671807775]