> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qredence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> Trust boundaries, credential storage, and sandbox options for Fleet Prime Agent.

Fleet Prime Agent runs on your machine, with your permissions, and executes model-generated Python and shell. Read this before pointing it at anything sensitive.

## Trust model

* The agent executes model-generated Python (`ipython`) and shell (`bash`) commands **with your user permissions**.
* IPython kernels and worker processes improve isolation but are **not a security sandbox**. See `SECURITY.md` in the repo.
* The web server binds to `127.0.0.1` and has **no multi-user auth**. Do not expose it beyond localhost without your own auth layer.

## Credential storage

Credentials resolve, in order:

1. Runtime overrides (`setRuntimeApiKey`, populated by `--api-key`). In-memory only.
2. Environment variables (`packages/ai/src/env-api-keys.ts`), unless `--no-env` is set.
3. `~/.prime/agent/auth.json` (mode `0600`), through `FileAuthStorageBackend`.
4. OAuth flows (`packages/ai/src/providers/oauth/`) for providers that support them.

`packages/ai` no longer persists OAuth credentials itself; callers do (usually via `auth.json`). Long-running sessions refresh OAuth tokens dynamically via `getApiKey` so mid-run expiry doesn't break the run.

## Environment forwarding

`DAEMON_CLIENT_ENV_KEYS` in `packages/coding-agent/src/modes/daemon/daemon-protocol.ts` limits which env vars a client can forward to the daemon. Everything else stays on the client.

## Optional OS sandbox

`packages/coding-agent/examples/extensions/sandbox/index.ts` adds an OS-level sandbox powered by `@anthropic-ai/sandbox-runtime`. It's disabled by default. Enable it when running the agent against untrusted content or in shared environments.

## Related

* [Configuration](/fleet-prime-agent/reference/configuration) — where credentials live.
* [Web app](/fleet-prime-agent/interfaces/web) — localhost binding, no multi-user auth.