Security and privacy

Studio combines local device access, organization-synchronized context, cloud AI, external integrations, and optional remote control. Security depends on keeping each action inside the correct organization, channel, credential, tool, and human-approval boundary.

​

Security model

• The desktop and local helper reach hosts and the workstation’s network from the machine running Studio.
• Altostrat organizations isolate administration, shared context, policy, and synchronized resources.
• Personal credentials and explicitly managed shared credentials have different scopes.
• Copilot tool availability is narrowed by organization, member, channel, and worker policy.
• State-changing, destructive, and unknown actions pause for review unless a high-trust setting bypasses it.
• Browser, Computer Use, generated apps, and Studio Remote add separate control surfaces that must be enabled and reviewed deliberately.

​

Trust boundaries

​

Credentials and Key Chain

Use Key Chain references instead of placing secrets in prompts, procedures, connector definitions, memories, artifacts, or channel context. Studio supports:

• Personal credentials — private to the member and appropriate for user-attributed host or integration access.
• Shared credentials — an explicitly provisioned organization/service identity for allowed members and tools.

Sharing a host, connector, or MCP definition does not automatically share a personal credential. An admin can see a member’s credential readiness marker without seeing the private value. Shared credentials require an owner, external rotation process, and least privilege. Removing a member from Studio does not rotate a shared password, token, or key in the external system.

​

Keep secrets out of AI context

Studio resolves supported credential references at execution so Copilot does not need the raw value in its normal tool-planning context. This protection is strongest when the value stays in Key Chain. Do not store credentials in:

• Organization, member, or channel context.
• Operational or organization memory.
• Generated app source or app state.
• Dashboard variables.
• Procedure Markdown or default arguments.
• Artifacts, recordings, or transcripts.

​

Tool policy and approvals

Tool policy controls availability; approvals control a proposed call. They solve different problems. Organization policy sets a maximum. Member and channel policy can narrow it. A digital-worker stage can narrow its grants again. Runtime dispatch re-checks this effective policy, so a stale tool reference is not enough to bypass a later restriction. Review an approval as if you were performing the action manually:

1. Confirm organization and channel.
2. Confirm target and credential scope.
3. Read the exact command, request, fields, or click/type action.
4. Check side effects, rollback, and whether the call is idempotent.
5. Prefer one-time approval over Allow for session when the scope may change.

Autopilot and browser autopilot bypass approvals in their scope. They are appropriate only for bounded, pre-verified work.

​

Browser and Computer Use

Browser sessions expose a live view, proposed intent, and Take over/Release control. The browser’s autopilot toggle can auto-approve website actions for that session. Computer Use requires macOS Screen Recording to observe and Accessibility to control. Read-only observation is distinct from clicking, typing, scrolling, or opening an app. State-changing desktop actions normally require approval. Prefer a terminal, connector, MCP tool, or other structured operation over pixel control when available.

​

Sandboxed dashboard apps

Generated dashboard apps run in a sandbox. External capabilities are disabled until you grant the exact requested set. Grants are per user and bound to a capability hash; a changed capability request must be reviewed again. Limit resource origins, inspect the app’s purpose and revision, and test with capabilities disabled before granting network or mutation access.

​

Studio Remote

A paired iPhone can read supported conversation state, send messages, and respond to approval requests while the desktop remains the execution bridge. Protect the phone with device authentication and notification privacy. Revoke a pairing from Current connections when the phone is lost, replaced, shared, or no longer needed. Generate a new pairing code if the displayed code may have been exposed. Do not approve an action from a notification preview alone.

​

Recordings, calls, and transcripts

Terminal replays, shared-session output, call media, Audio Use transcripts, and generated summaries can contain sensitive operational data. Tell participants when recording or transcription is active and follow applicable consent and retention rules. Transcription can be wrong. Confirm names, numbers, credentials, and commands against the live source before executing or distributing them.

​

Organization memory and search

Organization memory removes credential-like metadata before persistence, but the user-controlled title, summary, locator, and tags must still be non-secret. It records last-known state and must not be used as proof that a deployment or service is currently running. Search respects the current Studio scope, but a shared artifact or memory can still expose what its author placed inside it. Review content before changing visibility.

​

Sign out and offboarding

Sign out before transferring or servicing a workstation. It ends the authenticated Studio session and removes the current user’s active access from the app; synchronized organization data remains governed by the organization. For offboarding, also transfer owned resources, remove membership, revoke Studio Remote connections, replace personal-credential dependencies, and rotate any external shared credentials the person could use.

​

Reporting a security issue

Use Altostrat’s support or security contact from your account surface. Include the Studio version, operating system, organization ID, time of the event, affected surface, and a redacted reproduction. Never attach live secrets.

​

Related