Product · Security
Everything an agent reads can try to take control of it: emails, web pages, other agents. Bitfolk assumes some of it is hostile and stops it before any tool runs.
Only you give orders
Leaders take goals and directives only from the signed-in owner or lead. Everything an agent or outside source writes is data, marked with where it came from.
Quarantine
External content is read first by a quarantined model that has no tools and returns only structured fields. The Mayor, which has tools, never sees the raw text.
Taint
A run that read untrusted content is marked tainted. High-risk actions in a tainted run always go to you, whatever the autonomy dial says.
Audit
Each run logs what it read with trust levels, every tool call and its policy decision, and whether it was tainted. Teams can export it to their SIEM.
Assume some of what your agents read is hostile. Then make sure it can never be the thing that gives the orders.
Leaders only take instructions from signed-in humans. Everything else is treated as data, read first by a quarantined model with no tools, and any run that read untrusted content needs your approval for risky actions.
When a run reads untrusted content, Bitfolk marks it tainted. Tainted runs cannot take high-risk actions on their own, so an injected instruction cannot quietly send email or delete data.
No. Agents call Bitfolk's proxy, which adds the key, checks the policy and strips any copy of the secret from the response.
Yes. Pick the Strict profile or build a custom one. Team admins set a minimum that members can tighten but never loosen.
Security is on in every plan.