Network and permission boundaries

No single control should carry the entire security policy. Pneum.ai layers infrastructure isolation, network boundaries, connector boundaries, tool visibility, and approvals.

Cloud isolation

Each hosted agent uses a separate VM and disk. Credentials, notes, tools, and runtime data are not shared automatically between agents. Use separate agents when projects or identities require a stronger boundary than profiles provide.

Network layer

Internet exposure uses an HTTPS endpoint and source-IP allowlist. Tailscale exposure uses tailnet identity, MagicDNS, HTTPS, and tailnet policy. Teams Funnel publishes only its intended Activity endpoint.

Avoid wide CIDR ranges and general-purpose tunnels. A healthy service should not be reachable from a network that does not need it.

Connector layer

First-party connectors restrict repositories, channels, projects, chats, or Salesforce object types. These allowlists are enforced inside adapters before external API calls.

Use immutable IDs where the platform provides them. Display names can change or collide.

Tool-profile layer

A profile controls which tool schemas an agent can call. Removing a tool is stronger than telling the model not to use it. Give background agents only the tools required for their role.

Approval layer

Approval policy governs whether a permitted tool can execute a particular request. Argument-bound grants are narrower than tool-wide grants. External write and deletion actions should expose exact arguments and diffs where possible.

Credential layer

Use dedicated credential forms and the secret store. Never put secrets in system prompts, notes, workspace files, screenshots, or chat messages. Rotate upstream credentials after suspected exposure and update only the affected connector.

Review checklist

• Can the VM be reached only through the intended network?
• Can the connector reach only intended resources?
• Can the profile call only required tools?
• Do sensitive tools still ask with exact arguments?
• Are channel users authorized by immutable identity?
• Are credentials scoped and rotated appropriately?

For the security practices applied by the hosted service, also read the public Security page.