iPolloWork

Least-privilege permissions

• Limit agent credentials: Only grant each AI agent access to the specific tools, files, and systems it needs for its assigned task—do not give all agents full workspace access.
• Separate engine access: If using multiple AI engines (Codex, DeepSeek, OpenCode), isolate their credentials so a compromise of one engine does not expose secrets for the others.
• Plugin vetting: Before installing any plugin or skill, verify it comes from a trusted source and review what data it can read and modify—treat plugins like installing software on your computer.
• Regular credential rotation: Change API keys, passwords, and authentication tokens every 90 days, and immediately after any employee departure.

Network isolation

• Run locally only: Keep iPolloWork on a private, internal network or air-gapped machine; do not expose it to the internet unless absolutely required.
• Firewall rules: Block all outbound traffic except to known, approved AI engine endpoints (Codex, DeepSeek, OpenCode providers); log and review any exceptions.
• VPN for remote access: If teams need remote access, require a corporate VPN connection and multi-factor authentication before allowing connection to iPolloWork.
• No plugin auto-updates: Disable automatic updates for plugins and skills; manually review and approve each update before deployment.

Monitoring

• Audit agent actions: Log what each agent accesses, creates, or modifies—treat this like a security camera for who touched what and when.
• Review generated code: Before any AI-generated code is deployed or executed, have a human engineer review it for malicious, wasteful, or unintended logic.
• Watch for unusual behavior: Alert if an agent suddenly requests access to files outside its normal scope, or if multiple agents attempt to access the same sensitive data.
• Encryption at rest: Confirm that all local documents, designs, videos, and session data are encrypted on disk, not stored as readable plain text.

Red flags to watch for

• Unclear isolation between agents: If you cannot easily answer "what can Agent A access that Agent B cannot?", assume isolation is weak and escalate to your vendor or security team.
• Injected instructions in tasks: Watch for tasks or prompts that include suspicious code, commands, or requests to bypass security—these may be injection attacks trying to manipulate the AI.
• Untracked dependencies: If the tool relies on external libraries or AI engines that are not regularly audited or updated, flag this to leadership as a supply-chain risk.
• Missing or vague documentation: If the vendor cannot explain how credentials are stored, how agents communicate, or how data persists, do not deploy in production until answers are provided.