Safety

Each agent touches only what its job needs.

Specialists act on your behalf, so the limits are built into how they run, not left to a prompt. This is how.

Isolation

Each run is on its own. A model agent runs as a program on ContextStream’s model proxy; a sandbox agent runs in a fresh, isolated sandbox that is terminated when the run ends.

Code comes in as a clone of a public repository, and changes come out as a patch. Nothing is pushed for you.
A hybrid agent’s sandbox starts only on its program’s first command, so a declined run never starts one.
A hybrid agent’s file paths are fenced to its sandbox’s working directory.

No credentials in sandboxes

No sandbox receives a credential: not yours, not ContextStream’s, not the provider’s.

A sandbox agent cannot declare ContextStream scopes. The manifest is refused if it tries.
A hybrid agent’s sandbox starts with no environment. Every command, file, input and bundle file bound for it is checked for the run’s token, plain or encoded, and refused if it carries it.
What comes out of a sandbox is treated as data before any model reads it.

Egress allowlists

A sandbox may reach only the hosts its agent declares: a fixed list, or the hosts named in your input.

The runner applies the list as the sandbox’s egress policy where the provider can restrict egress, and records on the run whether it did.
Public sandbox agents also hold themselves to the list in their own HTTP client, on every hop of a redirect, whether or not the provider enforces it.
Site Auditor’s browser resolves only the page’s host and the hosts you allow. Requests to anything else are refused and listed.

The run token never reaches a model

A model run acts for you through a short-lived token that ContextStream mints for one user, one workspace, and only the scopes the agent’s job needs.

The token is held in one private place and sent only as the Authorization header of calls to ContextStream.
It never reaches a model’s context, a sandbox, logs, environment variables, telemetry or run views. Tests search everything that leaves a run for it.
Calls outside the agent’s declared scopes are refused before a request is made, and counted.

Your content is data, not instructions

Text a model reads from an image, a tool or your workspace is fenced as data, never handed over as instructions.

Of what is read from your workspace, only the run’s context pack goes into a model’s system message, as fenced blocks under rules the runner writes.
Citations are checked: an agent can cite only items its run actually found, and anything else is dropped.

Declines

An agent does its job and nothing else. A task outside the job is declined, with a reason, and costs nothing.

The scope check comes first, so a decline reads as little as possible: often nothing from your workspace at all.
A declined run does no work. A result that says declined but carries data, changed files or artifacts is refused.
An agent may only use its own tools. A call to any other tool is refused and counted.

Model calls only through ContextStream

Agents name a model alias, never a provider model, and call it only through ContextStream’s model proxy with the run’s token.

There are no provider keys in Slipstream’s agents, so ContextStream’s credits, spend gates and kill switch always apply.
Each run has a credit cap. ContextStream holds every model call against what the run has left before the call runs, and a workspace may set a lower limit.
A model call is retried only when the connection failed before any response, because a call that reached the proxy may already have been charged.

Small, named writes

What an agent may change in your workspace is part of its manifest, and each write is bounded.

One note per run, one doc per run, or one stored file per run, recorded as the agent’s.
Mail saves reply drafts for you to read and send. It never sends, moves or deletes mail.
Memory Gardener never changes anything itself: every merge or close is a proposal you accept or turn down.
PR Reviewer never comments on the host, approves or merges.